fix: handle errSecInteractionNotAllowed in KeychainCacheStore to prevent cache self-destruction on wake

[josepe98]

Problem

When the Mac wakes from sleep, the keychain is briefly locked. During this window, KeychainCacheStore.load calls SecItemCopyMatching and gets back errSecInteractionNotAllowed (-25308). This falls into the default case, returns .invalid, and the caller deletes the cache entry:

// In Repository.loadRecord
case .invalid:
    KeychainCacheStore.clear(key: ClaudeOAuthCredentialsStore.cacheKey)  // cache wiped

The cache entry was perfectly valid — it was just temporarily inaccessible. Deleting it forces a fresh read of "Claude Code-credentials" on the next access, which triggers a keychain prompt. This is why users see repeated password prompts after wake from sleep even after clicking "Always Allow".

Fix

Two small changes to KeychainCacheStore.load:

1. Apply KeychainNoUIQuery to the load query — consistent with how other no-UI reads are performed elsewhere in the codebase, and ensures the call fails fast with errSecInteractionNotAllowed rather than blocking.

2. Add an explicit case errSecInteractionNotAllowed that returns .missing instead of .invalid. The entry is valid but temporarily inaccessible — the caller should fall through gracefully and retry on next access, not destroy the cache.

Context

errSecInteractionNotAllowed is already handled explicitly in ClaudeOAuthCredentials.swift and KeychainAccessPreflight.swift, but was missed in KeychainCacheStore itself. The KeychainNoUIQuery helper exists precisely for this purpose but wasn't applied to cache reads.

Note: I'm a user who hit this bug (repeated prompts after wake) and traced it to this specific code path.

[steipete]

Landed via temp rebase onto main.

• Gate: swiftformat Sources Tests; swiftlint --strict; pnpm check; swift build; swift test -q; ./Scripts/compile_and_run.sh
• Land commit: 6d7b4aa
• Merge commit: aa26573

Thanks @josepe98!