unlock: decrypts a LUKS volume without mounting. Idempotent — reports
existing cleartext device if already unlocked.
lock: locks a LUKS volume. If mounted, unmounts first (udisks2 with
privileged fallback) then locks. Idempotent — reports if already locked.
Both commands support alias completion and config resolution.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
