Add ensureLocalSecretsKeyFile helper that generates a random 32-byte master key during onboard if using local_encrypted provider. Move resolveRuntimeLikePath to cli/src/utils/ for reuse by secrets-key and existing check modules. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>