Flaky test: cli/secret.test.ts shared-state/timing bug (test isolation)

[c-1k]

Pre-existing flake, unrelated to any feature PR — surfaced during #48 review but grep-confirmed the secret CLI path does not import govern's stream/settle code, so no feature change causes it.

Symptoms (nondeterministic, even in isolation)

Across consecutive isolated runs of packages/core/tests/cli/secret.test.ts: 2-failed → 13-passed → 1-failed. Two failure modes:

1. Test timed out in 5000ms (the add→rm→ls subprocess sequence, worse under machine load).
2. A JSON-parse error where a "Credential" log line leaks into ls --json output.

Root cause

Tests in the file share mutable state — a module-level logOutput array and a vault — without resetting between the run() subcommand invocations, so one test's log output bleeds into another's --json parse, and the shared vault + subprocess timing races the 5s test timeout.

Fix (test-only)

• Reset logOutput = [] and use a fresh per-test vault/tmpdir in beforeEach.
• await fully between chained subcommands (add → rm → ls) so output can't interleave.
• Consider bumping the per-test timeout for the subprocess-spawning cases, or parse ls --json from a cleanly-scoped capture rather than the shared buffer.

Low-frequency (CI has passed it on recent runs) so not merge-blocking, but worth fixing before the HN push since flaky CI erodes trust. Do as its own small test-only PR — do NOT fold into a feature branch.