secret : trousseau OS (keyring) + injection @secret au start/run (issue #36) - valeurs jamais affichees ni journalisees, mock testable, fallback clair sans trousseau

src/help.rs

@@ -385,6 +385,24 @@ pub static HELP_SPECS: &[HelpSpec] = &[
             HelpExample { desc: "List every alias.", code: "alias list" },
         ],
     },
+    HelpSpec {
+        name: "secret",
+        category: "Commands",
+        usage: "secret {flags} <set|unset|list>",
+        about: "Manage secrets in the OS keyring (values never shown or logged).",
+        search_terms: &["keyring", "token", "password"],
+        flags: &[],
+        subcommands: &[
+            ("set", "Store a secret for an agent"),
+            ("unset", "Remove a secret"),
+        ],
+        parameters: &[],
+        io: None,
+        examples: &[
+            HelpExample { desc: "Store a token.", code: "secret set OPENAI_KEY --agent claude-code --value sk-..." },
+            HelpExample { desc: "Use it at launch.", code: "start claude-code --env OPENAI_KEY=@secret" },
+        ],
+    },
     HelpSpec {
         name: "history",
         category: "Commands",