Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/audit/audit.go

@@ -0,0 +1,67 @@
+// Package audit writes an append-only, secret-redacted record of what incredigo
+// found and did. It never logs secret material — only metadata already known to
+// be non-secret (source, kind, redacted identity, location, action, outcome).
+package audit
+
+import (
+	"encoding/json"
+	"io"
+	"os"
+	"time"
+)
+
+type Entry struct {
+	Time     time.Time `json:"time"`
+	Action   string    `json:"action"` // "scan" | "migrate" | "status" | "export" | "import"
+	Source   string    `json:"source,omitempty"`
+	Kind     string    `json:"kind,omitempty"`
+	Identity string    `json:"identity,omitempty"` // already redacted upstream
+	Location string    `json:"location,omitempty"`
+	Outcome  string    `json:"outcome,omitempty"`  // "ok" | "skipped" | error string
+}
+
+type Log struct {
+	w   io.WriteCloser
+	now func() time.Time
+}
+
+// Open appends to path. An empty path yields a no-op log. clock supplies entry
+// timestamps (defaults to time.Now when nil) and is injectable for tests.
+func Open(path string, clock func() time.Time) (*Log, error) {
+	if clock == nil {
+		clock = time.Now
+	}
+	if path == "" {
+		return &Log{now: clock}, nil
+	}
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	return &Log{w: f, now: clock}, nil
+}
+
+// Write appends one JSON-lines entry. Caller is responsible for keeping Identity
+// redacted; this package does not inspect or sanitize values.
+func (l *Log) Write(e Entry) error {
+	if l.w == nil {
+		return nil
+	}
+	if e.Time.IsZero() {
+		e.Time = l.now()
+	}
+	b, err := json.Marshal(e)
+	if err != nil {
+		return err
+	}
+	b = append(b, '\n')
+	_, err = l.w.Write(b)
+	return err
+}
+
+func (l *Log) Close() error {
+	if l.w == nil {
+		return nil
+	}
+	return l.w.Close()
+}