globalenv: actually check read errors

It's possible that a key could be found, but not read, due to permission
errors (e.g. @u not linked to @s).
globalenv: use warn()/warnx() everywhere

I remember trying to decide whether I should use warn() or bare fprintf.
Seems like I decided on the latter. But now that I imported err.h in the
last commit anyway, might as well use it everywhere.
globalenv: use switch() for the modes
globalenv: explain reason for usage()
globalenv: check keyctl_unlink()
globalenv: reword error messages (s/key/variable/)
globalenv: add forgotten declaration