Group 2 of the manager wire-up — two CLI ItemUpdaters:
pass/gopass: the user's own password-store as a rotation source. Reads
line-1=password + key:value metadata via `<bin> show`; updates in place by
piping the full body to `<bin> insert -m -f` (off-argv), preserving metadata
across the password swap. gopass enumerates via `ls --flat`, pass by walking
the store dir; --pass-prefix scopes a subtree.
keychain: macOS internet passwords via the `security` CLI. Pure-exec (no
build tag) so it unit-tests cross-platform via a fake bin; Available() is
false off darwin. Read off-argv (find-internet-password -w); write is
delete+add with -w on argv (CLI limitation, documented like 1password).
Both MOCK-ONLY (fake-binary unit tests + leak checks); recorded as DATA in
BROWSER-ROTATION.md §8. 153 tests green, vet clean.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt