mathiasandClaude Opus 4.8
c93b433aaf
Implements ports.SecretStore over a 0600 JSON file as a stand-in for op/ESO so the demo runs without live op. Put persists atomically (temp + rename) and merges; Get returns ErrNotFound for unknown refs so a missing token fails loud. Behind the port, so swapping to op/ESO later is wiring, not code (ADR-002). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>