fix: probe the keychain with a read instead of writing an item at every launch

Startup wrote and deleted a probe item to see whether the keychain works,
waking D-Bus on Linux and risking a Keychain prompt on macOS. A read of a
missing entry answering 'no entry' proves the same; if a later write is
refused anyway, set_checked already falls back to the vault (F11).

Not verified against a live Secret Service or macOS Keychain in this
environment (no secret service here; the probe correctly reports it
unavailable).

rust/core/src/secrets.rs

@@ -272,9 +272,12 @@ impl Keychain {
         Keychain { service: service.into(), legacy: legacy.map(Into::into) }
     }
 
+    /// Probes with a read of an entry that doesn't exist: "no entry" proves the keychain answers,
+    /// without writing an item at every launch (which wakes D-Bus and can prompt on macOS). If
+    /// writes later fail anyway, `Secrets::set_checked` falls back to the vault.
     pub fn available(&self) -> bool {
         let service = self.service.clone();
-        off_runtime(move || entry(&service, "__nexus_keychain_probe__").and_then(|e| e.set_password("probe").and_then(|_| e.delete_credential())).is_ok())
+        off_runtime(move || matches!(entry(&service, "__nexus_keychain_probe__").and_then(|e| e.get_password()), Ok(_) | Err(keyring::Error::NoEntry)))
     }
 
     /// Reads a secret; a miss under the current service falls back to the legacy one and copies