Show what the keyring holds, without showing what it holds

Managing a stored credential meant installing Seahorse. The keyring
rows on Privacy could say whether it was locked and nothing about what
was in it.

Four rules, each pinned by a contract, because each is a way this could
leak the thing it exists to protect:

Listing never reads values. Enumerating reports labels and attributes;
it does not ask the keyring to hand over what it is protecting.

A secret never reaches a command line. /proc makes argv readable by
every process on this machine, so a password passed as an argument is
published to all of them. The helper reads the value in process and
writes it to wl-copy on stdin.

A secret never reaches an error message, a log, or a QML property. An
exception raised while holding a password does not get to choose what
text is printed, so the clipboard tool's stderr is discarded rather
than echoed.

Forgetting one is irreversible, so the first press asks and the second
does it, and the confirming button is the only one wearing danger.

The list is collapsed until asked for: opening Privacy should not
enumerate someone's passwords as a side effect. A copied value clears
itself about a minute later, but only if the clipboard still holds it --
the guard compares a SHA-256, so the waiting process never has the
password.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

docs/superpowers/plans/2026-08-19-desktop-integration.md

@@ -146,6 +146,21 @@ Seahorse.
 **Done when** a stored password can be found, inspected and removed without
 leaving Settings, and the contracts prove no value leaks on the way.
 
+**Landed 2026-08-19.** Built into Privacy & Security rather than as its own
+page: that page already claimed the topic, already had the keyring rows, and
+already answered the "saved passwords" search. A new page would have been a
+fourth page-registry edit for a card.
+
+The list is collapsed until asked for -- opening Privacy should not enumerate
+someone's passwords as a side effect -- and copying puts the value on the
+clipboard without it ever entering Quickshell: the helper reads it, writes it to
+`wl-copy` on stdin, and a detached guard clears it about a minute later only if
+the clipboard still holds it, comparing a SHA-256 rather than the password.
+
+Seahorse is not installed, so changing a keyring's password is not offered.
+Claiming a button that hands off to a missing application would be worse than
+not having it.
+
 ## Phase 6 — Backups (large, staged)
 
 The one genuinely missing safety net. `restic` is not installed.