fix(identity): keep an unbacked key safe on Replace and unblock a corrupt saved key - #3233

Summary

• Replace an unbacked key: when first run found another account's key on this computer, Replace deleted it even when it had no confirmed backup, and the dialog offered no way to copy it first. Now the dialog says to copy the key first and shows the same private-key controls as Settings' Remove from device. Replace stays disabled until the key is revealed or copied and I have my key is checked, the same gate as Settings. A key with a confirmed backup keeps the one-step Replace.
• Corrupt saved key: a saved key Buzz can't parse stopped launch on "Saved identity is malformed… contact support" with Retry. Retry reads the same bytes, so it could never work, and the app never opened, so Settings was out of reach. Now that page explains the problem and offers Remove from device. It confirms, then signs out as Sign out of Buzz does without erase. The next launch deletes the key and opens first run, which restores the account's backup or imports a key.
• Duplicate keyring entries (Windows, Linux): several keyring items matching one entry were reported as a malformed key. Deleting refuses for them too, so Remove from device would stop every later launch. They now get their own message, which says to remove the extra entries with the keyring app, and keep Retry.
• The launch read's "access was denied" message no longer says "no identity was created", which was wrong for a read.

Details

• src/features/identity/Welcome.tsx:
  • The replace dialog renders PrivateKey and an I have my key checkbox when the key has no confirmed backup. The checkbox is enabled after a reveal or copy (onInteraction), and Replace needs both. Each new question starts over.
  • The launch error page matches native's malformed answer (MALFORMED_IDENTITY) and shows Remove from device in place of Retry secure storage access. Its confirmation calls identity.signOut({ wipe: false, removeAgents: false }). A native refusal stays in the dialog with its reason, and the button can be pressed again. Other launch errors keep Retry.
• src/features/identity/service.ts: MALFORMED_IDENTITY holds native's exact text. A test reads identity.rs and checks it still matches, as the recovery messages already do.
• crates/credential-store: a new Error::Ambiguous for keyring's Ambiguous, which was Corrupt. Every other caller maps it as it mapped Corrupt, so only the identity read changes.
• src-tauri/src/identity.rs: Ambiguous gets its own AMBIGUOUS message, so the launch page keeps Retry. The launch read's denied message now ends "nothing was changed". Writes keep "no identity was created".
• docs/identity.md and docs/buzz-help.md describe both changes.
• Tests (identity.test.tsx):
  • An unbacked key: Replace is disabled until Copy private key and I have my key, the clipboard gets the key, and then Replace signs out. This includes both kgoose refusals.
  • A failed copy leaves the checkbox and Replace disabled. A reveal alone leaves Replace disabled; unchecking disables it again.
  • A backed-up key shows no copy controls, and Replace is enabled.
  • A malformed key: no Retry, Remove from device confirms, Cancel changes nothing, and confirming signs out without erase. A refusal shows its reason and can be tried again.
  • The native malformed text is pinned.

Known limits

• The in-app linked-key prompt (LinkedKeyCheck) is unchanged. It already warns, and Settings → Identity is reachable there for a copy.
• If secure storage refuses to export the key, Replace can't be enabled, and Cancel is the only way out until access works. That is the safe failure.
• The duplicate-entries case is traced from code; it wasn't run on Linux.
• A key that native can read but that is wrong in some other way is not covered. Only native's malformed answer offers removal.

🤖 Generated with Claude Code