Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/discover/docker.go

@@ -0,0 +1,78 @@
+package discover
+
+import (
+	"context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"sort"
+
+	"incredigo/internal/vault"
+)
+
+func init() { Register(&dockerScanner{}) }
+
+// dockerScanner reads ~/.docker/config.json. Each auths entry holds a base64
+// user:pass in "auth" (or an "identitytoken"). Read-only.
+type dockerScanner struct{}
+
+func (d *dockerScanner) Name() string { return "docker" }
+
+func (d *dockerScanner) path() string {
+	if p := os.Getenv("DOCKER_CONFIG"); p != "" {
+		return filepath.Join(p, "config.json")
+	}
+	home, _ := os.UserHomeDir()
+	return filepath.Join(home, ".docker", "config.json")
+}
+
+func (d *dockerScanner) Available() bool {
+	_, err := os.Stat(d.path())
+	return err == nil
+}
+
+func (d *dockerScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
+	p := d.path()
+	b, err := os.ReadFile(p) // read-only
+	if err != nil {
+		return nil, err
+	}
+	fi, _ := os.Stat(p)
+
+	var cfg struct {
+		Auths map[string]struct {
+			Auth          string `json:"auth"`
+			IdentityToken string `json:"identitytoken"`
+		} `json:"auths"`
+	}
+	if err := json.Unmarshal(b, &cfg); err != nil {
+		return nil, err
+	}
+
+	registries := make([]string, 0, len(cfg.Auths))
+	for r := range cfg.Auths {
+		registries = append(registries, r)
+	}
+	sort.Strings(registries) // deterministic order
+
+	var creds []Credential
+	for _, registry := range registries {
+		a := cfg.Auths[registry]
+		secret, kind := a.Auth, KindPassword
+		if secret == "" && a.IdentityToken != "" {
+			secret, kind = a.IdentityToken, KindToken
+		}
+		if secret == "" {
+			continue
+		}
+		creds = append(creds, Credential{
+			Source:   d.Name(),
+			Kind:     kind,
+			Identity: registry,
+			Location: p,
+			Modified: fi.ModTime(),
+			Secret:   v.Store([]byte(secret)),
+		})
+	}
+	return creds, nil
+}