fix(core): skip real keychain in tests to stop 15s keytar hangs

MasterKeyManager.loadKeytar() now bails out early when
FUSION_MASTER_KEY_DISABLE_KEYCHAIN=1, and the core vitest setup sets that
flag for every worker. Eight tests across master-key/secrets-store/
secrets-sync-passphrase were timing out at exactly the 15s testTimeout
because they constructed MasterKeyManager without injecting a fake
KeytarLike, which made loadKeytar() reach the real OS keychain.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.changeset/core-master-key-skip-keychain-in-tests.md

@@ -0,0 +1,5 @@
+---
+"@fusion/core": patch
+---
+
+Stop `MasterKeyManager` from probing the real macOS/Linux keychain during tests. A new `FUSION_MASTER_KEY_DISABLE_KEYCHAIN=1` env var forces the file backend, and the core vitest setup sets it so tests no longer hang for 15s in `keytar.getPassword(...)` on machines without a usable keychain.

packages/core/src/__test-utils__/vitest-setup.ts

@@ -114,6 +114,13 @@ function findRepoRoot(start: string): string {
 const repoRoot = findRepoRoot(realProjectRoot);
 process.env.FUSION_TEST_REAL_ROOT = repoRoot;
 
+// Prevent MasterKeyManager from hitting the real macOS/Linux keychain during
+// tests — keytar can block for 15s+ on CI-like environments. Tests that need
+// to exercise the keychain branch inject a fake KeytarLike via the constructor.
+if (!process.env.FUSION_MASTER_KEY_DISABLE_KEYCHAIN) {
+  process.env.FUSION_MASTER_KEY_DISABLE_KEYCHAIN = "1";
+}
+
 // Shared parent directory for all worker temp dirs in this run.
 // globalTeardown wipes this at the end of the suite.
 const WORKER_ROOT = join(tmpdir(), "fusion-test-workers");

packages/core/src/master-key.ts

@@ -228,6 +228,10 @@ export class MasterKeyManager {
       return this.injectedKeytar;
     }
 
+    if (process.env.FUSION_MASTER_KEY_DISABLE_KEYCHAIN === "1") {
+      return null;
+    }
+
     try {
       const require = createRequire(import.meta.url);
       const modName = `key${"tar"}`;