Cover macOS, Linux and WSL in the test suite and CI matrix

[Korijn]

The test suite needs an OS keyring that unlocks without user interaction, which is why CI only ran on Windows. Every other platform can provide one too, so CI now tests Linux, macOS and Windows on every supported Python version, plus WSL reaching the Windows credential manager.

Keyring setup per platform

• Windows: the credential manager is available to the session out of the box, unchanged.
• macOS: create a throwaway keychain, unlock it, disable auto lock, and make it the default keychain, which is the one the keyring package talks to.
• Linux: install gnome-keyring and run the tests inside a dbus-run-session with the daemon unlocked, since the secret service is bound to a d-bus session.

The tests that need a keyring skip themselves with a message when none is available, so contributors are not blocked on a headless machine. KEYCMD_REQUIRE_OS_KEYRING=1 turns those skips into failures, and CI sets it so a broken keyring setup cannot quietly gut a run rather than fail it.

WSL

The half of the WSL setup that can actually break is the interop boundary: keycmd installed on Windows, invoked from a shell inside WSL, reading the Windows credential manager. tests/test_wsl.py covers exactly that, in a job of its own that installs WSL, and it passes: keycmd finds its config, reads the credential out of the credential manager, and hands it to the command.

Working inside WSL needs no separate job, since there keycmd is a posix process talking to whichever keyring backend the distro provides, which is what the Linux job covers, daemon and all.

Notes on how that job is set up, both learned the hard way on this branch:

• Alpine on WSLv1. Provisioning WSLv2 with a store distribution took 44 seconds on one run and blew through a 20 minute timeout on the next. The tests only need a shell on the far side of the boundary, so the job now installs the Alpine root file system on the WSL version that needs no virtual machine. The whole job takes about 30 seconds.
• Nothing is quoted or backslashed. wsl.exe strips quotes and eats backslashes on its way to the distribution, which mangled the path of the console script and swallowed the $env: prefix of a variable reference. Paths are therefore translated in the test rather than by wslpath (which the Alpine root file system does not ship anyway), passed unquoted, and asserted to be free of spaces. The environment is printed with cmd /c set, which needs no quoting and works whichever shell keycmd detects on the Windows side.

Test suite

Everything platform specific moved into a new tests/conftest.py, which also removes the fixtures that were duplicated across three modules.

• The suite now exercises every shell of the platform that is installed (sh, bash, zsh and cmd, powershell, pwsh) instead of only the shell that happened to invoke pytest. Shells that are not installed are still covered by asserting on the command line keycmd builds for them, which is what covers the cmd /C branch on posix runners.
• Fixed the Windows-only assumptions that made the suite fail elsewhere: the exit status for a missing command is per shell (posix shells report 127, not 1), and non-ascii passwords are now exercised everywhere except through the Windows console.
• New coverage for the posix execvpe path (including exit status propagation and environment inheritance, verified in real subprocesses), the three shell detection fallbacks, --shell, --verbose, the missing command and invalid TOML errors, expose, the missing credential and missing alias errors, and the config walk stopping at the home folder and at the root of the file system.
• test_find_file no longer creates a file in the real home folder.

Coverage goes from 79% on Linux, with failures, to 100% on Linux, macOS and Windows alike. CI gates at 95%.

Unrelated and pre-existing: on Python 3.14 keycmd/conf.py:43 emits a DeprecationWarning about free-form TOMLDecodeError arguments. Left alone, since it is a source change rather than test or CI scope.