hermes - 💡(How to fix) Fix Hardening: optional OS-keystore (DPAPI/Keychain/libsecret) at-rest backing for auth.json

<!-- Suggested title: Hardening: optional OS-keystore (DPAPI/Keychain/libsecret) at-rest backing for auth.json -->

Filed as a §3.2 hardening idea, not a vulnerability — SECURITY.md (§2.3, §3.2) is clear that the on-disk credential file is inside the trust envelope and that in-process components can read it by design; OS-isolation is the boundary, and OpenShell's Provider store is the credential-isolation answer for that posture. This asks for an optional at-rest layer for operators not on that posture.

Context

For operators on the default local backend (not a container / not OpenShell — the common personal-machine setup), auth.json/.env tokens sit in cleartext, protected only by filesystem ACLs. That's the documented model. This is an opt-in at-rest layer for that population, in the same spirit as §4's "keep credentials in the operator credential file with tight permissions."

Why an at-rest option still helps (within the trust envelope)

• Long-lived OAuth refresh tokens (e.g. Google 1//…, non-expiring) and provider keys are high-value and durable.
• The plaintext proliferates beyond the one tight-permission file: create_quick_snapshot() copies .env+auth.json into state-snapshots/ (keep ≤ 20), and pre-update / hermes backup zips bundle them — with an os.chmod(0600) hardening step that's a no-op on Windows ACLs. An at-rest layer keeps those copies from being flat cleartext after a rotation.

Suggested direction

Optional, opt-in OS keystore backing — Windows DPAPI, macOS Keychain, Linux libsecret — or a passphrase-derived key, for the token store and (importantly) its snapshot/backup copies.

Acknowledged scope

Defense-in-depth, not a new boundary — user-scoped DPAPI is readable by same-user code, so it doesn't change the §2.2 model; the OS-isolation posture (container / OpenShell Provider store) stays the real credential-isolation answer. The value is raising the at-rest bar for default-backend users and de-cleartexting the duplicated snapshot/backup copies.