Keyring adjustments

docs/storage.md

@@ -7,7 +7,7 @@ How sherlock persists secrets and runtime state.
 | Topic | Decision |
 |---|---|
 | Token storage | OS keyring via [`github.com/zalando/go-keyring`](https://github.com/zalando/go-keyring). No on-disk credential files, no `age` blobs, no plaintext. |
-| Pre-flight | `sherlock` calls `keyring.Probe()` at startup of every subcommand. A missing/locked keyring fails fast with a platform-appropriate hint and exit code `3`. |
+| Pre-flight | The only constructor is `keyring.Open()`, which probes the keyring before returning a Store. There is no probe-less escape hatch. A missing/locked keyring returns `*UnavailableError` (with a populated `Hint` field) and exits 3. |
 | Service name | `sherlock` for real tokens; `sherlock-preflight` for the probe sentinel. |
 | Account key  | The Authentik `sub` claim once logged in, `default` before. |
 | Runtime files | `$XDG_RUNTIME_DIR/sherlock.sock`, `sherlock.pid`, `sherlock.log`, `sherlock/<agent>.mcp.json`. All `0600` (files) / `0700` (dirs). |
@@ -37,19 +37,19 @@ secrets.
 
 ## Pre-flight semantics
 
-`keyring.Probe()`:
+`keyring.Open()`:
 
-1. Writes a fixed sentinel value under service `sherlock-preflight`,
-   account `probe`.
-2. Reads it back, verifies the round-trip.
-3. Deletes it.
+1. Probes the keyring: writes a fixed sentinel value under service
+   `sherlock-preflight` / account `probe`, reads it back, deletes it.
+2. On success: returns a live `Store` backed by the OS keyring.
+3. On failure: returns `*keyring.UnavailableError` whose `Cause` field
+   wraps the underlying error and whose `Hint` field carries a
+   per-OS one-line remediation. `Error()` includes both, so callers
+   normally just print the error and move on; `keyring.IsUnavailable(err)`
+   is the type-predicate for branching.
 
-If any step fails the call returns `keyring.ErrUnavailable` wrapping
-the underlying cause. `keyring.IsUnavailable(err)` is the test;
-`keyring.RemediationHint()` returns a per-OS one-liner.
-
-CLI behaviour: any failure prints the wrapped error and the hint, then
-exits with code `3`.
+CLI behaviour: any failure prints the error (which already includes
+the hint) and exits with code `3`.
 
 ## Platform notes