feat(host): Keychain and Credential Manager token stores, a macOS/Windows CI job (P11a step 0)

The agent path was Linux-only because tokens had a keyring store only
there (every other OS hit NOT_YET, so `connect` and the bridge failed).
D-56's destination is one installation for macOS, Windows and Linux.
Both new stores sit behind the same Items trait as the Secret Service,
so INVARIANT 4 (one account, one item, locked is an error) is kept once
and tested once through the file keyring. Windows credentials have a
unique target name, so a probe stands in for a search.

New dependencies (ledger-host only, target-gated): apple-native-keyring-store
(feature keychain) and windows-native-keyring-store, the stores the
keyring-core 1 API we already use is published with. No ledger-core change.

The `portable` job builds and tests the workspace on macos-latest and
windows-latest. Windows is allowed to fail: the rest of the host is
Unix-only (inventory in docs/packaging.md). Not verified locally: no
macOS or Windows target is installed; CI is the evidence.

Also pins cargo-packager, cargo-packager-updater and cargo-generate-rpm
in mise.toml for the trial, and records that the trial is not yet run.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

.github/workflows/check.yml

@@ -34,3 +34,45 @@ jobs:
       - name: What the build used
         if: always()
         run: df -h / | tail -1
+  # The destination is one installation for macOS, Windows and Linux (D-56,
+  # P11a step 0): the workspace must build and pass its tests on each, not
+  # only here. `just check` (fmt, clippy, rustdoc, proofs' friends) stays
+  # the Linux job's; these run the build and the tests. The job tells
+  # which OS a failure is on; neither is allowed to hide the other.
+  portable:
+    name: portable (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            experimental: false
+          - os: windows-latest
+            experimental: true
+    runs-on: ${{ matrix.os }}
+    continue-on-error: ${{ matrix.experimental }}
+    # Same disk discipline as above: no incremental caches, line tables only.
+    env:
+      CARGO_INCREMENTAL: "0"
+      CARGO_PROFILE_DEV_DEBUG: line-tables-only
+      CARGO_PROFILE_TEST_DEBUG: line-tables-only
+    steps:
+      - uses: actions/checkout@v4
+      - name: Rust (the version mise.toml pins)
+        shell: bash
+        run: rustup toolchain install 1.99 --profile minimal && rustup default 1.99
+      - name: Room for the build
+        shell: bash
+        run: df -h . | tail -1
+      - name: The server-only build (no viewer)
+        run: cargo build -p ledger-cli --no-default-features
+      - name: Everything compiles
+        run: cargo build --workspace --all-targets
+      - name: Tests
+        run: cargo test --workspace
+      - name: The real OS keyring keeps and forgets a token
+        run: cargo test -p ledger-host --lib -- --ignored os_keyring
+      - name: What the build used
+        if: always()
+        shell: bash
+        run: df -h . | tail -1