blast+cli: read-only blast-radius map + wire rotate --execute / --blast

internal/blast builds a read-only consumer map (which other files appear to
use each credential) from NON-secret metadata only — env-var names, hostnames,
identifiers — never the vault secret; rotation needs it to know what to
redeploy after a change. cmd/incredigo wires Mode A `rotate --execute`
(reconstructs Source from the gopass path segment, runs the execute spine) and
surfaces the blast-radius map. Adjusts a worklist test accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/worklist/worklist_test.go

@@ -17,11 +17,15 @@ func TestBuildAndMarkdown(t *testing.T) {
 	if len(items) != 3 {
 		t.Fatalf("got %d items, want 3", len(items))
 	}
-	// No drivers are registered yet, so everything is manual.
-	for _, it := range items {
-		if !it.Manual() {
-			t.Errorf("item %q unexpectedly has driver %q", it.Credential.Identity, it.Driver)
-		}
+	// git and docker have no driver (manual); ssh now has a registered driver.
+	if !items[0].Manual() {
+		t.Errorf("git item should be manual, got driver %q", items[0].Driver)
+	}
+	if items[1].Manual() || items[1].Driver != "ssh" {
+		t.Errorf("ssh item should be auto via driver %q, got %q", "ssh", items[1].Driver)
+	}
+	if !items[2].Manual() {
+		t.Errorf("docker item should be manual, got driver %q", items[2].Driver)
 	}
 	// github link is curated; ssh has no web page.
 	if items[0].Link.URL != "https://github.com/settings/tokens" {
@@ -37,7 +41,8 @@ func TestBuildAndMarkdown(t *testing.T) {
 		"3 credential(s)",
 		"https://github.com/settings/tokens",
 		"alice @ github.com",
-		"— (no web page)", // ssh row
+		"auto: ssh",        // ssh now driver-handled
+		"— (no web page)",  // ssh row has no link
 	} {
 		if !strings.Contains(md, want) {
 			t.Errorf("markdown missing %q\n---\n%s", want, md)