fix: lazysecrets list puts the name first, and keeps errors out of fzf

cmd/lazysecrets/main.go

@@ -17,6 +17,7 @@ import (
 	"time"
 
 	tea "charm.land/bubbletea/v2"
+	"golang.org/x/term"
 
 	"git.kebcloud.no/keb/lazysecrets"
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
@@ -122,7 +123,7 @@ func run() error {
   lazysecrets [flags] get <ref>   print the value a lazysecrets:// link points at,
                                   for scripts: VAR=$(lazysecrets get <ref>)
   lazysecrets [flags] list [--cached] [--max-age 2m] [--format text|json]
-                          [--color always|never] [--icons=false]
+                          [--color always|never] [--icons=false] [--errors]
                                   print every source, vault and secret it can
                                   find, one per line, for fzf and pickers:
                                   what's cached at once, then what loads
@@ -357,7 +358,12 @@ Flags:
 		if d, err := config.CacheDir(); err == nil && !*demo && config.On(cfg.Storage.Cache) {
 			cachePath = filepath.Join(d, "cache.json")
 		}
-		return listCmd(providers, cachePath, timeoutFor, theme, *icons, listArgs, os.Stdout, os.Stderr)
+		// Into a pipe (fzf), stderr would draw over what reads it.
+		errOut := io.Discard
+		if term.IsTerminal(int(os.Stdout.Fd())) {
+			errOut = os.Stderr
+		}
+		return listCmd(providers, cachePath, timeoutFor, theme, *icons, listArgs, os.Stdout, errOut, os.Stderr)
 	}
 	if shareArgs != nil {
 		// The files from a repo, the key from whichever provider it's