refactor: share writable native secret backends (RFC 0011)

[rmanibus]

Closes #138

Summary

• move native secret write and exists behavior into shared internal/secretref writable backend capabilities
• refactor macOS keychain write support to live with the keychain backend instead of CLI-local helper files
• update interactive store prompting to use writable backend capabilities rather than hard-coded platform-specific secret store helpers

Testing

• go test ./internal/secretref ./cmd/cloudstic
• golangci-lint run ./internal/secretref/... ./cmd/cloudstic/...

[codecov]

Codecov Report

❌ Patch coverage is 63.11475% with 45 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/secretref/secretref.go	56.25%	14 Missing and 7 partials ⚠️
internal/secretref/keychain_backend.go	53.65%	15 Missing and 4 partials ⚠️
internal/secretref/keychain_backend_stub.go	0.00%	5 Missing ⚠️

📢 Thoughts on this report? Let us know!