refactor(host): tokens live in a file under the data root (U0e)

D-63: the 0700 data root is the trust boundary already (I-1: hidden, not
locked), so the OS keyring added no wall and cost headless servers a D-Bus
session, CI a knob and every OS its own store. The file keeper is the only
store: run/tokens/, 0600, written atomically. The three keyring stores, the
file_keyring knob and their tests are removed; an unreadable token file is an
error, never no token.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

crates/ledger-host/Cargo.toml

@@ -18,10 +18,6 @@ base64 = "0.22"
 # `wanderbooks download` checks what arrived against its Repr-Digest.
 sha2 = "0.10"
 tokio-util = { version = "0.7", features = ["rt"] }
-# Agents' tokens are kept in the OS keyring (plan 3.3, 3.5): the Secret
-# Service on Linux, the login Keychain on macOS, the Credential Manager on
-# Windows (P11a step 0).
-keyring-core = "1"
 # The owner passphrase is typed at the terminal, unechoed.
 rpassword = "7"
 # Token texts and passphrases are wiped from memory when dropped.
@@ -30,15 +26,6 @@ zeroize = "1"
 [target.'cfg(unix)'.dependencies]
 libc = "0.2"
 
-[target.'cfg(target_os = "linux")'.dependencies]
-zbus-secret-service-keyring-store = { version = "1", features = ["rt-async-io-crypto-rust"] }
-
-[target.'cfg(target_os = "macos")'.dependencies]
-apple-native-keyring-store = { version = "1.0.2", features = ["keychain"] }
-
-[target.'cfg(windows)'.dependencies]
-windows-native-keyring-store = "1.1.0"
-
 [dev-dependencies]
 tempfile = "3"