acq(msb): acq secret ls shows no rows on a Linux secret-tool keychain host #252

Summary

Fast-follow from the #233 (feat/msb-parity) adversarial review (SHOULD-FIX S3).

acq_backend_secret_ls (via acq_secret_list_keys in acq.backends/secret-store.sh) enumerates only the file-backend directory. On a keychain-linux host (secret-tool), acq_secret_store writes secrets into the keychain, so the file dir is empty and acq secret ls prints just the header even when secrets are stored.

• macOS defaults to the file fallback, so ls is accurate there.
• On Linux + secret-tool, the keychain is the default write path (not an opt-in), so the ls contract is inaccurate on a whole platform.

No security issue — no secret values leak; the gap is functional/accuracy only (an operator can't see what's stored).

Suggested fix (one of)

1. Enumerate via the meta sidecar dir as a secondary source (it already records host+env per stored service, keyed the same way), so keychain-backed entries still list.
2. Or, when the active backend is keychain-linux, print an explicit note (e.g. keychain-linux secret stores are not enumerable by name) instead of an empty list.

Option 1 is preferable — it makes ls correct on all backends without a caveat.

Pointers

• acq.backends/secret-store.sh — acq_secret_list_keys (~L390), acq_secret_store keychain write path (~L160), and the meta sidecar (acq_secret_meta_*).
• acq.backends/msb.sh — acq_backend_secret_ls.

Context

Reviewer (wz-gsa) OK'd deferring this to a fast-follow rather than expanding #233. Filing per AGENTS.md §15.5 so the deferral is tracked.

AI-assisted (OpenCode); human-reviewed.