Security. keyring built "KEYRING_PASSWORD=...; USER_PASSWORD=...; <dispatch>",
two statements, so the shell could not exec away and its argv carried both
secrets for the command's lifetime - readable by any local user through ps.
Both now go through remoteexec.ExecWithEnv (transport v0.4.0).

The one real exposure of 24 credential-prefixing modules: a prefix on a LONE
command is not visible, because the shell execs into it. Measured both shapes
rather than assumed.

Also: keyringDispatch builds both platform branches into one string, so a
literal password in the macOS branch was on the command line even on Linux.
It reads "$USER_PASSWORD" now.

Minor, not patch: the macOS branch's command text changed.