fix(desktop): skip keychain write when blob contents are unchanged

[wpfleger96]

On v0.3.38, every persona/model edit re-prompts for the macOS keychain password. Root cause: mutate_blob() unconditionally called write_blob_raw() on every invocation, and on macOS the legacy SecKeychain write is a distinct ACL operation from the "Always Allow"-ed read. save_managed_agents → persist_agent_keys serialises the blob on every save — even for a model change that touches no key — producing N prompts per agent per save.

What this changes

secret_store.rs — mutate_blob() copy-on-write idempotent write

Builds the candidate state in a separate next allocation. Compares next to the current cached map (current) — if equal, returns Ok(()) without calling write_blob_raw(). Only after write_blob_raw() succeeds does the cache advance to next.

Two invariants this preserves:

Idempotent: a model/persona save that changes no key produces zero keychain writes and zero prompts.

Copy-on-write durable: if write_blob_raw() fails (denied prompt, transient outage, ACL rejection), the cache stays at the last known durable state. A subsequent store() for the same key/value still sees a diff from the durable cache and retries the write. Without this, the prior in-place mutation left the cache ahead of storage — a later equal-value store() would skip the write, persist_agent_keys would clear the inline copy, and on restart the key would be absent from both JSON and keychain.

managed_agents/storage.rs — persist_agent_keys_with() seam + test fixes

Extracts persist_agent_keys_with(store, records) over the KeyStore trait seam (mirrors hydrate_keys_with()). Adds record_with_pubkey_and_key helper so tests can use distinct pubkeys per record.

Tests (828 passing)

• mutate_blob_skips_write_when_map_unchanged — pre-seeded cache, re-store same value, returns Ok(()) without reaching write_blob_raw() (would error on unsigned CI).
• mutate_blob_does_not_advance_cache_on_write_failure — pre-seeded cache, store new key (fails on unsigned CI), asserts cache remains at pre-seeded state and failed key is not visible via load().
• persist_agent_keys_issues_zero_writes_when_inline_keys_already_cleared — dominant prompt-storm path: all keys already persisted, model changes, write_count = 0.
• persist_agent_keys_writes_once_per_record_with_inline_key — two agents with distinct pubkeys/keyring names, each triggers exactly one write, inline copies cleared after persist.