fix: replace remaining os.Setenv with t.Setenv in tests

Replace all os.Setenv calls with t.Setenv in test functions to ensure
proper test environment cleanup and better test isolation. This leaves
only legitimate application code and helper functions using os.Setenv.

internal/secret/passphrase_test.go

@@ -131,18 +131,8 @@ func TestPassphraseUnlockerWithRealFS(t *testing.T) {
 		}
 	})
 
-	// Save original environment variables and set test ones
-	oldPassphrase := os.Getenv(secret.EnvUnlockPassphrase)
-	os.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
-
-	// Clean up after test
-	defer func() {
-		if oldPassphrase != "" {
-			os.Setenv(secret.EnvUnlockPassphrase, oldPassphrase)
-		} else {
-			os.Unsetenv(secret.EnvUnlockPassphrase)
-		}
-	}()
+	// Set test environment variable (cleaned up automatically)
+	t.Setenv(secret.EnvUnlockPassphrase, testPassphrase)
 
 	// Test getting identity from environment variable
 	t.Run("GetIdentityFromEnv", func(t *testing.T) {