feat: add Secretive CLI management commands

[illera88]

Why

Secretive currently assumes an interactive GUI setup flow. That works for individual users, but it breaks down for fleet deployment where a management tool like Kandji needs to provision Secretive ahead of time.

The goal of this PR is to make Secretive scriptable enough to support managed rollout of SSH signing keys, especially in environments using SSH certificates. With these commands, an automation can:

• install and verify the SecretAgent helper
• create a Secretive key with the required metadata
• discover the public key and its stand-in paths
• print the integration snippets needed to wire SSH or shell environments to Secretive

That makes it possible to automate the parts that currently require opening the app and clicking through setup, while keeping the existing GUI workflow intact.

What Changed

This PR adds CLI support for:

• creating a secret with configurable name, protection level, key type, and attribution
• listing existing secrets
• installing, uninstalling, and inspecting SecretAgent state
• printing the SecretAgent socket path
• printing integration snippets for ssh, zsh, bash, and fish
• resolving a secret's public key path by --id or --name
• exporting a secret's public key by --id or --name

Help Output

Usage:
  Secretive create-secret --name <name> [--protection-level <1|2|3>] [--key-type <ecdsa-256|mldsa-65|mldsa-87>] [--key-attribution <value>]
  Secretive list-secrets
  Secretive install-agent
  Secretive uninstall-agent
  Secretive agent-status
  Secretive socket-path
  Secretive print-integration --tool <ssh|zsh|bash|fish>
  Secretive public-key-path (--id <id> | --name <name>)
  Secretive export-public-key (--id <id> | --name <name>)

Protection levels:
  1  require authentication
  2  notification
  3  current biometrics

Integration tools:
  ssh   print ~/.ssh/config content using IdentityAgent
  zsh   print ~/.zshrc content exporting SSH_AUTH_SOCK
  bash  print ~/.bashrc content exporting SSH_AUTH_SOCK
  fish  print ~/.config/fish/config.fish content exporting SSH_AUTH_SOCK

Defaults:
  protection-level: 1
  key-type: ecdsa-256
  key-attribution: omitted

Testing

• xcodebuild -project Sources/Secretive.xcodeproj -scheme Secretive -configuration Debug CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO build
• xcodebuild -project Sources/Secretive.xcodeproj -scheme PackageTests test CODE_SIGNING_ALLOWED=NO
• manually exercised the signed Debug app CLI for:
  • create-secret
  • list-secrets
  • public-key-path
  • export-public-key
  • install-agent
  • uninstall-agent
  • agent-status
  • socket-path
  • print-integration variants

Related Issues

• Related to Command-line interface #328 (Command-line interface)
• Related to Make it possible to get a public key from the name chosen in Secretive via shell/CLI #499 (Make it possible to get a public key from the name chosen in Secretive via shell/CLI)
• Adjacent context: Support for 1-to-Many relationship between Key and Certificates #791 (Support for 1-to-Many relationship between Key and Certificates)