Refuse an existing vault before asking for the mnemonic (closes #151)

`secret init` and `secret vault create` asked for the mnemonic and the
unlocker passphrase, and `secret init` printed "Initialized secrets
manager at", before refusing a vault that already exists. The check
`vault.CreateVault` made before writing is now `vault.CheckNewVaultName`,
which both commands call while holding the state directory lock, before
the first prompt; `CreateVault` still calls it. `secret init` prints the
"Initialized" line only once the vault is created, so
`TestMnemonicNotReadNamesOnlyMnemonic` no longer expects it.

Judgement call: the same check validates the name, so `secret vault
create` with an invalid name also fails before the prompts.

Model: opus-5-5

TODO.md

@@ -18,6 +18,15 @@ https://git.eeqj.de/sneak/secret/milestone/12
 
 # Completed Steps
 
+- 2026-10-14: `secret init` and `secret vault create` refuse a vault that
+  already exists before asking for the mnemonic or the unlocker passphrase
+  (https://git.eeqj.de/sneak/secret/issues/151). They used to ask for both and
+  only then refuse, and `secret init` printed "Initialized secrets manager at"
+  before the refusal. The new `vault.CheckNewVaultName`, which
+  `vault.CreateVault` also calls, checks the name while the command holds the
+  state directory lock, before the first prompt; `secret init` prints that line
+  only once the vault is created. `secret vault create` with an invalid name
+  also fails before asking.
 - 2026-10-14: `secret generate mnemonic`, `secret vault list` and
   `secret unlocker list` print their output to stdout, as `secret list` does, so
   it can be piped or captured (https://git.eeqj.de/sneak/secret/issues/138).