fix(init): clarify secrets fallback wording

[rianjs]

Summary

• Rename the legacy/default keyring path in cr init secrets management to a fallback/compatibility path.
• Show a platform-aware automatic OS default label such as Automatic OS default (macOS Keychain).
• Describe the in-memory backend as ephemeral and intended for tests/CI, not normal local use.

Verification

• go test ./internal/cmd/credentialcmd
• make check
• tmux TUI verification at 120x40 with isolated home:
  • Opened cr --backend memory init > Configure secrets management.
  • Captured Fallback credential store: Automatic OS default (macOS Keychain).
  • Captured Legacy fallback credential store and Fallback persistent backend.
  • Selected In-memory store and captured Ephemeral; best suited for tests or CI, not normal local use.

Closes #340

[rianjs]

Findings

Minor: The diff changes the separate inventory/accessibility legacy form in editLegacySecretsManagement (Legacy Fallback Credential Store, Legacy fallback credential store backend, fallback action labels), but the added tests and tmux evidence cover the default linear editor path plus inventory rows/options, not that form output. Add a small test that drives the legacy form/inventory path and asserts those new labels so this second UI path does not drift.

Nit: initLegacySecretsBackendFieldDescription uses “macOS Keychain on Darwin” in user-facing copy. “Darwin” is the Go/platform name; use “on macOS” for the TUI text.

[rianjs]

Minor coverage gap: the new legacy-fallback test stops at editLegacySecretsManagement instead of driving EditKeyringBackend through the inventory row selection, so a bug in wiring the fallback row to this form would still pass. The same pattern appears in the linear-editor check, which validates the document state after mutation but not the fully rendered layout.Content, so it does not quite prove the on-screen copy end to end. Given the change is copy-only, I’d treat this as follow-up coverage rather than a blocker.

[monit-reviewer]

Automated PR Review

Reviewed commit: a6b2177

Approved with 1 non-blocking suggestion below. Address at your discretion.

Summary

Reviewer	Findings
harness-engineering:harness-self-documenting-code-reviewer	1

harness-engineering:harness-self-documenting-code-reviewer (1 findings)

💡 Suggestion - internal/cmd/credentialcmd/init_secrets_management_editor.go:187

The new initSecretsManagementFieldLegacyBackend handler omits the explicit return that initSecretsManagementFieldBackend has after calling initSecretsManagementSyncLinearFields. If the two paths should behave identically, add return; if the legacy path intentionally falls through to later OnChange logic, a short comment explaining why would eliminate the ambiguity.

2 PR discussion threads considered.

---

Completed in 2m 16s | $1.34 | sonnet | daemon 0.2.132 | Glorfindel

Field	Value
Model	sonnet
Reviewers	hybrid-synthesis, harness-engineering:harness-architecture-reviewer, harness-engineering:harness-enforcement-reviewer, harness-engineering:harness-knowledge-reviewer, harness-engineering:harness-self-documenting-code-reviewer, security:security-code-auditor
Engine	claude · sonnet
Reviewed by	pr-review-daemon · monit-pr-reviewer
Duration	2m 16s wall · 2m 13s compute (Reviewers: 1m 46s · Synthesis: 27s)
Cost	$1.34 (estimated)
Tokens	270.1k in / 12.5k out
Turns	12

Per-workstream usage

Workstream	Model	In	Out	Cache read	Cache create	Cost
hybrid-synthesis	sonnet	35.5k	1.4k	13.8k	21.7k (1h)	$0.16
harness-engineering:harness-architecture-reviewer	sonnet	45.0k	592	13.8k	31.2k (1h)	$0.20
harness-engineering:harness-enforcement-reviewer	sonnet	47.0k	2.3k	13.8k	33.2k (1h)	$0.24
harness-engineering:harness-knowledge-reviewer	sonnet	46.1k	1.5k	13.8k	32.3k (1h)	$0.22
harness-engineering:harness-self-documenting-code-reviewer	sonnet	51.4k	6.0k	13.8k	37.6k (1h)	$0.32
security:security-code-auditor	sonnet	45.2k	737	13.8k	31.4k (1h)	$0.20

_{Re-reviews only run when @monit-reviewer is re-requested as a reviewer — push as many commits as you need, then re-request when ready. PRs targeting branches other than main, master are skipped, even when @monit-reviewer is re-requested.}

[monit-reviewer]

🔵 Low (harness-engineering:harness-self-documenting-code-reviewer): The new initSecretsManagementFieldLegacyBackend handler omits the explicit return that initSecretsManagementFieldBackend has after calling initSecretsManagementSyncLinearFields. If the two paths should behave identically, add return; if the legacy path intentionally falls through to later OnChange logic, a short comment explaining why would eliminate the ambiguity.

Reply to this thread when addressed.