Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/discover/ssh.go

@@ -0,0 +1,67 @@
+package discover
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+
+	"incredigo/internal/vault"
+)
+
+func init() { Register(&sshScanner{}) }
+
+// sshScanner harvests private keys from ~/.ssh (files named id_* that aren't
+// .pub). The whole key file is the secret. Read-only.
+type sshScanner struct{}
+
+func (s *sshScanner) Name() string { return "ssh" }
+
+func (s *sshScanner) dir() string {
+	home, _ := os.UserHomeDir()
+	return filepath.Join(home, ".ssh")
+}
+
+func (s *sshScanner) Available() bool {
+	fi, err := os.Stat(s.dir())
+	return err == nil && fi.IsDir()
+}
+
+func (s *sshScanner) Scan(ctx context.Context, v *vault.Vault) ([]Credential, error) {
+	entries, err := os.ReadDir(s.dir())
+	if err != nil {
+		return nil, err
+	}
+	var creds []Credential
+	for _, e := range entries {
+		name := e.Name()
+		if !e.Type().IsRegular() || !strings.HasPrefix(name, "id_") || strings.HasSuffix(name, ".pub") {
+			continue
+		}
+		p := filepath.Join(s.dir(), name)
+		b, err := os.ReadFile(p) // read-only
+		if err != nil {
+			continue
+		}
+		if !bytes.Contains(b, []byte("PRIVATE KEY")) {
+			continue // not a private key file
+		}
+		fi, _ := os.Stat(p)
+		// Best-effort: PEM-encrypted keys carry an explicit marker. (OpenSSH-format
+		// encryption isn't detectable without parsing the body, so this can
+		// under-report; it never claims a plaintext key is encrypted.)
+		encrypted := bytes.Contains(b, []byte("ENCRYPTED"))
+		creds = append(creds, Credential{
+			Source:   s.Name(),
+			Kind:     KindPrivateKey,
+			Identity: name,
+			Location: p,
+			Modified: fi.ModTime(),
+			Secret:   v.Store(b),
+			Meta:     map[string]string{"encrypted": strconv.FormatBool(encrypted)},
+		})
+	}
+	return creds, nil
+}