secret list gives each secret's own creation and last-update times (closes #142)

secret list and secret list --json gave the time of the listing as every
secret's creation and last-update time, because Secret.LoadMetadata set
both to the current time. It now reads file modification times, so
listing still needs no passphrase: the last update is when the secret's
current file was written, and the creation is when its oldest version's
value.age was written.

GetSecretObject no longer loads the times, so secret get reads no more
files than before and keeps its error for a missing current file;
secret list calls LoadMetadata itself.

Judgement call: the creation time comes from value.age, not from the
oldest version's directory, whose time changes when the next add
rewrites that version's metadata.age.

Model: opus-5-5

README.md

@@ -150,6 +150,12 @@ Retrieves and outputs a secret value to stdout.
 
 Lists all secrets in the current vault. Optional filter for substring matching.
 
+The `LAST UPDATED` column, and `updated_at` in the `--json` output, give the
+time the secret's `current` file was last written: every command that adds a
+version replaces it, and so does `secret version promote`. `created_at` gives
+the time the `value.age` of the secret's oldest version was written. Both are
+the files' modification times, so listing asks for no passphrase.
+
 #### `secret remove <secret-name> [--force]` / `secret rm` ⚠️ 🛑
 
 **DANGER**: Permanently removes a secret and ALL its versions. It first asks for