test: cover newrelic keychain metadata

[rianjs]

Summary

• bump cli-common to the immutable pseudo-version containing test: cover macOS keychain metadata cli-common#64
• add a Darwin+cgo gated empirical test that writes through nrq's keychain adapter with an injected newrelic-cli/ config and inspects ByteNess Keychain metadata for newrelic-cli//api_key
• keep config/state hermetic while restoring HOME only for real macOS Keychain default-keychain discovery

Verification

• go list -m github.com/open-cli-collective/cli-common
• go mod tidy -diff
• go test ./internal/keychain
• NRQ_KEYCHAIN_METADATA_TEST=1 go test ./internal/keychain -run TestKeychainMetadataGated -count=1 -v
• go test ./...
• make test
• make verify

Closes #131

[rianjs]

Major

• internal/keychain/keychain_metadata_darwin_test.go#L31 only exercises a first-write case. It creates a fresh synthetic profile, calls SetAPIKeyOverwrite, and checks the resulting metadata, but it never seeds an existing Keychain item with stale or blank metadata before the overwrite. That means the test would still pass if SetAPIKeyOverwrite regressed to a plain set, or if the fixed macOS metadata behavior only worked when replacing an existing item. To prove the intended overwrite behavior, seed newrelic-cli/<profile>/api_key first, confirm the pre-overwrite metadata is wrong/blank, then assert overwrite updates label and description.

[monit-reviewer]

PR review failed and the daemon has stopped retrying for this commit. I am removing my pending review request to stop the automated review cycle. Re-request @monit-reviewer to retry, or push a new commit and re-request.

[monit-reviewer]

Automated PR Review

Reviewed commit: b46879b

Manually approved via CLI.