refactor: tidy up sharing after the round of tweaks

- Go to's picker settings are one picker struct, set while picking.
- Opening a share link plans the save, then asks or saves; no more
  offerWrite doing either by a flag.
- Closing the picker while it encrypts cancels the share, and a
  second pick meanwhile is ignored.
- Favourites and Recent leave out plain env values as keys too.
- share.key in the config is checked with share.ParseKey, so
  {{secrets/…}} is refused there already.
- A key that can't be read reads the same opening as sharing
  ("can't use …"); KeyError moved to share.go, maxFiles is
  maxUnpacked (bytes), and a stray comment is gone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/config/config_test.go

@@ -73,6 +73,7 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
 		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
 		"share key":  "share:\n  key: https://kv.vault.azure.net/\n",
+		"workspace":  "share:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "share:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "share:\n  keyRules:\n    minClasses: 5\n",
 	} {