Fix Keychain access prompts after Homebrew upgrades

[rianjs]

Summary

cr keeps triggering macOS credential-manager prompts after Homebrew upgrades, even after the user chooses Always Allow.

Recent investigation shows:

• darwin release binaries are being code-signed correctly with a stable designated requirement
• Homebrew installs each cask version under a versioned Caskroom path
• Keychain ACLs on codereview/* generic-password items can retain stale trusted-application paths and stale partition_id entries across upgrades
• config show and other read paths can also prompt unnecessarily because credential presence checks currently read secret data instead of using metadata/ref-only existence checks

Desired outcome

For codereview-cli, complete one end-to-end fix/verification cycle before applying the pattern to sibling CLIs.

The ticket is only complete when we have:

1. an implementation that addresses unnecessary prompt amplification in cr
2. focused tests for the changed behavior
3. a merged release build
4. a real post-merge install/upgrade verification on the Homebrew-installed CLI
5. a clear conclusion, based on empirical evidence, about what self-signed signing can and cannot fix for Keychain ACL / partition behavior

Scope

• implement the codereview-cli side of the fix train first
• use cli-common changes as needed
• do not start the other affected CLIs until the installed cr build has been verified after merge/release/upgrade

Acceptance criteria

• cr config show does not read secret values just to determine credential presence
• the chosen fix path is covered by tests
• release artifacts are built and published successfully
• brew upgrade --cask open-cli-collective/tap/codereview-cli is run against the merged release
• the installed binary and the corresponding Keychain item state are inspected after upgrade
• the ticket records whether the post-upgrade behavior is actually fixed, partially mitigated, or still blocked by self-signed partition_id behavior

Notes for implementation

• prefer evidence over assumptions when dealing with Keychain ACLs
• if self-signed auto-repair cannot survive upgrade in practice, document the limitation plainly and stop short of claiming a durable fix
• stale local Keychain garbage from repeated manual Always Allow attempts can be cleaned up as a post-merge local step, but that cleanup is not itself the product fix

[rianjs]

Post-merge execution plan for this ticket:

1. Merge fix: avoid keychain secret reads for exists checks cli-common#65 after external review.
2. Re-pin this branch to the resulting cli-common main-branch commit (squash merge changes the hash), then rerun go test ./... and merge this PR.
3. Wait for auto-release + release workflow completion on codereview-cli.
4. Confirm the released version and Homebrew cask update.
5. On the test machine, run brew upgrade --cask open-cli-collective/tap/codereview-cli.
6. Verify the installed binary and behavior, including:
   • codesign -d -r- /opt/homebrew/Caskroom/codereview-cli/<version>/cr
   • cr config show --profile codex-rianjs-bot --json
   • targeted stale-item probe if needed to confirm the metadata-backed Exists path remains non-blocking on the installed build
7. Clean stale codereview/* Keychain entries after validation.
8. Only after that end-to-end validation, create follow-up issues for sibling CLIs as needed.

[rianjs]

Post-merge release verification for the #405 fix:

• Released codereview-cli tag: v0.10.198
• Release URL: https://github.com/open-cli-collective/codereview-cli/releases/tag/v0.10.198
• Homebrew cask updated to 0.10.198; local upgrade succeeded with brew upgrade --cask open-cli-collective/tap/codereview-cli
• Installed CLI now reports cr 0.10.198 (8bbca6abc9c0b24a81f73ec3c1b3a811f3cac645, 2026-06-30T13:58:39Z)
• Installed binary path: /opt/homebrew/Caskroom/codereview-cli/0.10.198/cr
• Codesign DR remains stable: identifier "org.open-cli-collective.cr" and certificate leaf = H"42e1afd02aae8666c09c15f171e1639550f301c2"
• TeamIdentifier=not set, as expected for the current self-signed certificate
• Empirical profile check: cr --profile codex-rianjs-bot config show --json completed immediately from the installed brew build and returned both configured credential refs as present without hanging on the stale-item/probe path.

Conclusion: the released Homebrew build contains the cli-common v0.4.1 mitigation and verifies the intended no-secret-read metadata/probe behavior for config discovery. This is still not an Apple Developer ID fix; direct secret reads can still require the normal self-signed Keychain approval path after upgrades.