Ask for the passphrase on the controlling terminal, not stdin (closes #144)

The passphrase and mnemonic prompts open /dev/tty and ask there, so
`echo v | secret add s1 --force`, `secret encrypt` and `secret decrypt`
with piped input ask at a terminal instead of failing. Only a process
with no controlling terminal still gets the error naming the variable to
set; stdin and stderr no longer matter.

On SIGINT or SIGTERM, Entry() restores the settings of /dev/tty instead
of stdin, since that is where the prompt turns echo off; with stdin
piped, Ctrl-C at the prompt otherwise left echo off.

The two tests that pin the no-terminal message run the binary in a new
session, so it has no terminal wherever the tests run.

Unverified by a test: the echo restore after Ctrl-C, checked by hand.

Model: opus-5-5

internal/cli/unlock_failure_test.go

@@ -16,6 +16,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"syscall"
 	"testing"
 
 	"filippo.io/age"
@@ -223,7 +224,7 @@ func TestMoveUnlockFailureNamesVault(t *testing.T) {
 }
 
 // TestPassphraseNotReadNamesNoMnemonic runs `secret get x` on the built
-// binary without SB_UNLOCK_PASSPHRASE and with a stdin that is not a
+// binary without SB_UNLOCK_PASSPHRASE and in a new session, which has no
 // terminal, so the passphrase cannot be read. The unlocker was not tried,
 // and adding one would need a passphrase read the same way, so the error
 // is the cause alone, without the advice to use the mnemonic.
@@ -254,15 +255,16 @@ func TestPassphraseNotReadNamesNoMnemonic(t *testing.T) {
 		"PATH=" + os.Getenv("PATH"),
 		"HOME=" + os.Getenv("HOME"),
 	}
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true}
 
 	output, err := cmd.CombinedOutput()
 	require.Error(t, err)
 
 	assert.Equal(t, "Error: failed to unlock vault: "+
 		"failed to get long-term key: failed to get unlocker identity: "+
-		"failed to read passphrase: stdin is not a terminal (piped input or "+
-		"script). Please set the SB_UNLOCK_PASSPHRASE environment variable or "+
-		"run interactively\n", string(output))
+		"failed to read passphrase: there is no terminal to ask on. Please "+
+		"set the SB_UNLOCK_PASSPHRASE environment variable or run "+
+		"interactively\n", string(output))
 }
 
 // TestCryptoUnlockFailureNamesMnemonic checks that `secret encrypt` and