Encrypted-file secret store (swift-crypto, supersedes Keychain direction) #35

Design decision 3: replace the Keychain-backed secret approach (per-run password prompts on macOS: ad-hoc signed CLI binaries can never earn durable Keychain trust) with an encrypted-file store under the state root. Prompt-free, tri-OS.

Construction (decision 3ii): swift-crypto directly, no AlgoKit. AlgoChat's Crypto/ is the reference design: ephemeral X25519 ECDH + HKDF + ChaCha20-Poly1305 envelope; unlock via passphrase (KDF) or key file. Related: #16 and PR #27 (their read-back verification and tests are the pattern to keep; the backend changes).

Acceptance criteria

• secret key round-trips set/get/reset through the encrypted store with zero interactive prompts
• Store file lives under the state root (--state-dir/APS_HOME respected); contents are ciphertext at rest
• Works on macOS + Linux; no Security.framework/Keychain imports
• Tests + smoke cover round-trip and wrong-passphrase failure (exit code per Error contract: exit-code taxonomy + JSON error envelope #31 taxonomy)
• specs updated in the same change

Locked decisions (design interview round 2, 2026-07-18)

• Unlock: key file at /secret.key (mode 0600) generated on first use, zero prompts. Passphrase hardening opt-in via APS_SECRET_PASSPHRASE env var; interactive TTY prompt (our prompt, not macOS) only as fallback when passphrase mode is on. Agents always non-interactive in both modes.
• Format: custom envelope (ephemeral X25519 + HKDF + ChaCha20-Poly1305, AlgoChat Crypto/ as reference). age/rage interop deferred to a later export/import feature, not a format constraint.