Initial commit: Incredigo — local-first RAM-only credential custody

v1: discover → migrate → expiry tracking → sealed export/import.

- vault: memguard mlock/DONTDUMP arena, handle indirection, zeroize-on-drop
- discover: registry + 8 read-only scanners (aws, env, netrc, ssh, docker,
  kube, git) and a file/dir harvester (--path)
- sink: gopass streaming insert; length-prefixed bundle framing; Sealer
  interface with three impls — age (default, authenticated), hmac
  (authenticated, openssl-only encrypt-then-MAC), openssl (CBC fallback,
  unauthenticated; OpenSSL 3.x enc refuses AEAD)
- policy: local expiry engine, 60d/8w threshold parser
- audit: redacted append-only JSONL, injectable clock
- export/import: passphrase from no-echo prompt or $INCREDIGO_PASSPHRASE into
  locked memory; secrets stream gopass<->Sealer as bytes, never Go strings
- tests: scanner leak-checks, vault zeroize, bundle round-trip via fake gopass;
  go test ./... green, -race clean

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/sink/sealer.go

@@ -0,0 +1,24 @@
+package sink
+
+import (
+	"context"
+	"io"
+
+	"github.com/awnumar/memguard"
+)
+
+// Sealer produces and opens portable, agent-independent encrypted backup bundles.
+//
+// gopass already GPG-encrypts every entry, so incredigo deliberately does NOT
+// double-wrap individual secrets. A Sealer instead seals the whole exported set
+// into one blob that can be restored on a bare machine with nothing but this one
+// tool and a passphrase — no gpg-agent, no keyring.
+//
+// openssl is the default implementation (see openssl.go). Because this is an
+// interface, a contributor can drop in age (github.com/FiloSottile/age) without
+// touching anything else in incredigo.
+type Sealer interface {
+	Name() string
+	Seal(ctx context.Context, plaintext io.Reader, out io.Writer, pass *memguard.LockedBuffer) error
+	Open(ctx context.Context, in io.Reader, out io.Writer, pass *memguard.LockedBuffer) error
+}