Put age identity keys into locked buffers through one function (closes #38)

secret.IdentityToLockedBuffer replaces the eight places that converted
an age identity's String() to bytes for a locked buffer and left the
string, which holds the private key, in ordinary memory. It moves the
string's own bytes into the buffer, which overwrites them. The copies
age makes while encoding the key remain; the function's comment says
so. TODO.md drops these places from the 1.0 memory-security entry,
along with its stale version.go reference.

Model: opus-5-5

internal/cli/crypto.go

@@ -91,8 +91,7 @@ func (cli *Instance) storeNewEncryptionKey(
 		return nil, fmt.Errorf("failed to generate age key: %w", err)
 	}
 
-	// Store the generated key directly in a secure buffer
-	secureBuffer := memguard.NewBufferFromBytes([]byte(identity.String()))
+	secureBuffer := secret.IdentityToLockedBuffer(identity)
 
 	err = vlt.AddSecret(secretName, secureBuffer, false)
 	if err != nil {