fix: fix _agenix_generation being (very shortly) empty if readlink fails

[teatwig]

I'm currently trying to improve agenix (mostly for myself) and realized that _agenix_generation never gets set properly. When basename wraps readlink in quotes, the or condition that would return 0 never gets executed because basename "" doesn't fail.

This isn't really a problem atm because (( ++_agenix_generation )) will treat empty variables as if they were 0, but might lead to some issues in the future. I moved the condition to the readlink subshell, which shouldn't cause any issues since basename "0" will just return 0. I also wrapped ${cfg.secretsDir}in quotes in case someone sets it to a path with spaces.