feat(desktop): store nsec private keys in the OS keyring

[wpfleger96]

What

Desktop nsec private keys move from plaintext on disk into the OS keyring, matching goose's model. Previously the human identity lived in identity.key and every managed-agent key was inlined in managed-agents.json — both world-readable plaintext. A new secret_store.rs (keyring 3.6.3, vendored, target-gated apple-native / windows-native / sync-secret-service) backs them with the macOS Keychain, Windows Credential Manager, or the Linux Secret Service.

The system-keyring cargo feature is on by default. When no keyring backend is reachable (headless Linux with no Secret Service), keys fall back to a 0o600 owner-only file. The BUZZ_PRIVATE_KEY env var still takes precedence over both stores everywhere it did before, so harnessed agents and CI are unaffected.

Migration

On first launch after upgrade, existing plaintext keys are imported into the keyring, read back to verify the round-trip, and only then is the plaintext destroyed (identity.key deleted; agent keys stripped from managed-agents.json). Migration runs only when the keyring is reachable — if the backend is unavailable that session, the app keeps the plaintext authoritative and does not migrate, so a transient outage can never resurrect a rotated key from a leftover file.

The private_key_nsec field becomes #[serde(skip)]-style in-memory-only and is hydrated from the keyring on load, so it stops landing in JSON. A single write chokepoint in save_managed_agents covers both migration and fresh agent creation — a newly created agent's key persists to the keyring through the same path, surviving restart.

Plaintext-never-lingers guarantees

• Human identity: the keyring-Present boot arm cleans up a leftover identity.key only after a successful keyring load and parse — never on a failed read, so a delete can never race ahead of a confirmed key. Closes the window where a prior migration's remove_file failed (AV lock, read-only mount, EPERM) and left plaintext on disk indefinitely.
• Agent keys: a save during a transient keyring outage keeps the key inline in managed-agents.json for survival; the next reachable boot deterministically re-migrates it via the non-mutating migrate_inline_key helper and the following save writes clean JSON. The no-resurrection guard holds — keyring Unreachable keeps the key inline and never migrates.

Fail-closed on keyring outage

A keyring that is reachable at write time but unreachable on a later boot must never silently rotate or deploy a keyless identity:

• Silent identity rotation: a fresh install that generates straight into a reachable keyring writes the identity.migrated marker on keyring-success, so a later keyring-Unreachable boot sees the marker (not "no file, no marker", which is indistinguishable from a never-launched machine) and fails closed rather than generating a new key. On the keyring-write-failure → file-fallback arm the marker is deliberately not written, since the key is then authoritative in the 0o600 file.
• Empty-key provider deploy: build_deploy_payload reuses the same spawn_key_refusal guard that fronts the local spawn path, so a provider deploy with an empty private_key_nsec (left by a keyring outage after hydration) fails closed instead of launching an agent with no identity. Create-deploy records the refusal in the agent's last_error; start-deploy propagates it.

Docs

SECURITY.md gains the keyring storage section and corrects the audit-log description: the chain is a keyless SHA-256 hash chain (buzz-audit/src/hash.rs), tamper-evident not tamper-resistant — the prior "HMAC-chained" claim was false.

[wesbillman]

Thanks for moving desktop nsec storage toward the OS keyring — that fits Buzz's identity/security direction. I found one blocking availability edge case: after a successful migration, a later keyring outage can silently rotate the human identity or leave managed-agent secrets empty. Please fail closed or add a safe fallback/recovery story for post-migration keyring-unavailable boots.

[wesbillman]

Pinky adversarial review: requesting changes for two keyring outage safety gaps. Narf!