v0.80.0 moved keyring's passwords off the command line in keyringGet and
keyringSet. keyringDelete, which only state=absent reaches, kept building
"KEYRING_PASSWORD=<secret>; <dispatch>" and the regression test passed
because it drove state=present only.

Patch: no API change, and the fix completes what v0.80.0 claimed.

The test is now a table over every state, each case carrying a witness
command its own state must reach - otherwise a case that returns early
passes by finding no secret in no commands.