refactor(host): tokens live in a file under the data root (U0e)

D-63: the 0700 data root is the trust boundary already (I-1: hidden, not
locked), so the OS keyring added no wall and cost headless servers a D-Bus
session, CI a knob and every OS its own store. The file keeper is the only
store: run/tokens/, 0600, written atomically. The three keyring stores, the
file_keyring knob and their tests are removed; an unreadable token file is an
error, never no token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

.github/workflows/check.yml

@@ -70,8 +70,6 @@ jobs:
         run: cargo build --workspace --all-targets
       - name: Tests
         run: cargo test --workspace
-      - name: The real OS keyring keeps and forgets a token
-        run: cargo test -p ledger-host --lib -- --ignored os_keyring
       - name: What the build used
         if: always()
         shell: bash