fix(core): cover Linux keyring access with a pure-Rust Secret Service client

The keyring crate's Linux backend requires C libdbus, which cross builds
(zigbuild) cannot link, so Linux desktop users hit the same
desktop-migrated-but-MCP-blocked failure that macOS/Windows users hit in
0.4.94 - with no native build to fix it on. Replace the Linux keyring
path with the secret-service crate (pure-Rust zbus, no C dependencies,
speaks the session-bus protocol directly), keeping the exact on-disk
attribute layout the keyring crate writes (target/service/username,
with the legacy no-target fallback) so existing desktop-provisioned
keys remain readable both ways.

- connect/collection failures (no session bus, headless servers) map to
  a missing provider so callers keep falling back to the managed
  .dbx/secret.key file exactly as before
- found-but-unreadable keyring items now fail fast with a specific
  KEYRING_ACCESS_FAILED code on every platform instead of silently
  provisioning a new key that would strand existing ciphertext
- the Linux zigbuild MCP/CLI package legs build with os-keyring

Cargo.lock

@@ -2190,6 +2190,7 @@ dependencies = [
  "rusqlite",
  "rustls 0.23.43",
  "rustls-pemfile 2.2.0",
+ "secret-service",
  "serde",
  "serde_json",
  "serde_yaml_ng",
@@ -4862,7 +4863,6 @@ checksum = "eebcc3aff044e5944a8fbaf69eb277d11986064cba30c468730e8b9909fb551c"
 dependencies = [
  "byteorder",
  "dbus-secret-service",
- "linux-keyutils",
  "log",
  "secret-service",
  "security-framework 2.11.1",
@@ -5020,16 +5020,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "linux-keyutils"
-version = "0.2.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83270a18e9f90d0707c41e9f35efada77b64c0e6f3f1810e71c8368a864d5590"
-dependencies = [
- "bitflags 2.13.1",
- "libc",
-]
-
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -9711,6 +9701,7 @@ dependencies = [
  "signal-hook-registry",
  "socket2 0.6.5",
  "tokio-macros",
+ "tracing",
  "windows-sys 0.61.2",
 ]
 
@@ -11677,6 +11668,7 @@ dependencies = [
  "serde_repr",
  "sha1 0.10.7",
  "static_assertions",
+ "tokio",
  "tracing",
  "uds_windows",
  "windows-sys 0.52.0",