feat(secrets): S5 — keyring-backed secrets login with WSL2 env-var fallback (spec 04)

[gustavobertoi]

What

Completes M4's S5: keyring-backed provider credentials with a clean WSL2 degrade path.

How

internal/secrets/keyring.go:

• Keyring interface + OSKeyring (zalando/go-keyring — Secret Service / Keychain / Credential Manager, namespaced devstack) + MemKeyring in-process fallback.
• KeyringAvailable probes by round-tripping a sentinel; any failure (notably WSL2 without D-Bus) → false.
• CredentialFor(k, provider) resolves in spec-04 order: explicit env (DEVSTACK_<PROVIDER>_TOKEN) → managed keyring entry → "" (provider-native default). S3/S4 providers will consume this.

CLI: real secrets login|logout|status (replaces the stub).

• login <provider> --token … stores the credential; on a keyring-less host it degrades — warns, names the env var to set, exits 0 (tool keeps working).
• status [provider…] reports keyring availability + per-provider source (env|keyring|none).
• An openKeyring seam makes both branches deterministically testable.

Tests

internal/secrets: Mem round-trip; KeyringAvailable true/false; CredEnvVar formatting; CredentialFor resolution order (env > keyring > none; nil-safe). internal/cli: login persists + status shows keyring; login degrades without keyring (warns, names env var, stores nothing); login requires --token. make ci green.

Deps / constraints

go-keyring + godbus + wincred are all pure-Go → CGO_ENABLED=0 static build intact. govulncheck: only local go1.26 stdlib advisories (N/A to CI's Go 1.25.x); zero module-level findings against the new deps.

Spec acceptance (spec 04)

• Provider credential resolution order: env → managed keyring → native default.
• On WSL2 without D-Bus, secrets login degrades to env-var mode with a clear warning (tool still works).

🤖 Generated with Claude Code