- Replace panic() calls in seunlocker_stub.go with error returns,
following the existing keychainunlocker_stub.go pattern
- Fix hardcoded derivation index 0 in getLongTermKeyForSE: now reads
vault metadata to use the correct DerivationIndex (matching
getLongTermPrivateKey in keychainunlocker.go)
- Add tests for SE unlocker exports in secret package (both darwin
and non-darwin stub tests)
- Update README to reflect SE implementation: remove 'planned' labels,
update Apple Developer Program references, add secure-enclave to
unlocker type lists and examples
- Run go fmt on files with import ordering issues
Change NewCLIInstance() and NewCLIInstanceWithFs() to return
(*Instance, error) instead of panicking on DetermineStateDir failure.
Callers in RunE contexts propagate the error. Callers in command
construction (for shell completion) use log.Fatalf. Test callers
use t.Fatalf.
Addresses review feedback on PR #18.
