Leave no partial unlocker directory when adding an unlocker fails (closes #48)

CreatePGPUnlocker looked up the GPG key's fingerprint, and the keychain
unlocker got the long-term key, only after writing part of the unlocker,
so a failure there left a directory with no metadata. Both now do every
step that can fail before writing anything. `secret unlocker add pgp`
looks the fingerprint up once, for its duplicate check, and passes it to
CreatePGPUnlocker to record. All four unlocker types write their files
through the new secret.WriteDir, which builds a new directory in a
temporary directory, renames it into place when complete and removes it
on a failure. A directory that already exists, as when an unlocker
replaces one of the same name, is written in place and never removed.

Model: opus-5-5

internal/secret/pgpunlocker_test.go

@@ -43,8 +43,6 @@ func installFakeGPG(t *testing.T) {
 // fails because on macOS there is no mnemonic and no current unlocker, and
 // on every other platform it always fails
 // (https://git.eeqj.de/sneak/secret/issues/88).
-//
-//nolint:paralleltest // t.Setenv forbids t.Parallel
 func TestCreatePGPUnlockerFailureWritesNothing(t *testing.T) {
 	installFakeGPG(t)
 	t.Setenv(secret.EnvMnemonic, "")