fix(core): cover Linux keyring access with a pure-Rust Secret Service client

The keyring crate's Linux backend requires C libdbus, which cross builds
(zigbuild) cannot link, so Linux desktop users hit the same
desktop-migrated-but-MCP-blocked failure that macOS/Windows users hit in
0.4.94 - with no native build to fix it on. Replace the Linux keyring
path with the secret-service crate (pure-Rust zbus, no C dependencies,
speaks the session-bus protocol directly), keeping the exact on-disk
attribute layout the keyring crate writes (target/service/username,
with the legacy no-target fallback) so existing desktop-provisioned
keys remain readable both ways.

- connect/collection failures (no session bus, headless servers) map to
  a missing provider so callers keep falling back to the managed
  .dbx/secret.key file exactly as before
- found-but-unreadable keyring items now fail fast with a specific
  KEYRING_ACCESS_FAILED code on every platform instead of silently
  provisioning a new key that would strand existing ciphertext
- the Linux zigbuild MCP/CLI package legs build with os-keyring

.github/workflows/mcp-release.yml

@@ -424,7 +424,7 @@ jobs:
         shell: bash
         run: |
           if [[ "${{ runner.os }}" == "Linux" ]]; then
-            cargo zigbuild --release -p dbx-cli --no-default-features --target "${{ matrix.target }}.2.31"
+            cargo zigbuild --release -p dbx-cli --no-default-features --features dbx-mcp/os-keyring --target "${{ matrix.target }}.2.31"
           else
             # Same keychain rationale as the MCP native legs; the feature is
             # forwarded through the dbx-mcp dependency.
@@ -662,9 +662,9 @@ jobs:
         shell: bash
         run: |
           if [[ "${{ runner.os }}" == "Linux" ]]; then
-            # Linux zigbuild cannot link the dbus Secret Service backend; the
-            # managed .dbx/secret.key file remains the key material source.
-            cargo zigbuild --release -p dbx-mcp --target "${{ matrix.target }}.2.31"
+            # Pure-Rust (zbus) Secret Service backend: no C libdbus, so the
+            # zigbuild legs can read desktop-provisioned keys too.
+            cargo zigbuild --release -p dbx-mcp --features os-keyring --target "${{ matrix.target }}.2.31"
           else
             # Native macOS/Windows builds read the OS keychain key that DBX
             # Desktop provisions during the data security upgrade, so the MCP