Selecting Sign in with Buzz key now dispatches the read of the saved Buzz
owner key immediately. The extra Beehive confirmation before it is removed:
selection itself is the explicit user gesture. While the read is in flight
the status line keeps the custody disclosure (Keychain read only, session
only, no local copy) and states that an OS keychain permission dialog is
separate and never bypassed or promised away.
Saved-key and matching-key import sign-in keep their confirmation and
input paths; helper source, owner matching, session-only custody,
cancellation and all backend behavior are unchanged. The test-only fixture
gains an inert env-gated pacing knob so a PTY driver can observe the
pending state and exercise Esc cancellation deterministically.
Verified with the synthetic source-UI PTY driver in a fresh
beehive-pairing-cli- HOME with explicit BEEHIVE_TEST_CREDENTIAL_FILE,
installed loader and service fences; production Keychain never read: one
selection reaches signed-in controls with no further Beehive input, and
Esc still cancels the in-flight read. Focused 12/12 backend and 8/8
renderer suites and package typecheck re-passed.
Signed-off-by: Logan Johnson <loganj@squareup.com>
e9d5a0d9f9