fix: a demo repo's SOPS value can be the share key

The demo provider finds repos by their remote, as the repo provider
does, so a key in a demo repo's SOPS file can be read. Opening a
share link uses the repo's clone only when it's on disk (the demo's
aren't), else asks where to save. The demo GitHub client secret is 40
characters, like real ones, so it passes share.keyRules.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/fake/fake.go

@@ -134,13 +134,14 @@ func (p *Provider) Value(ctx context.Context, o provider.Object) (provider.Secre
 	return provider.NewSecretValue([]byte(v)), nil
 }
 
-// Locate finds the source holding the vault (by host) or the workspace.
+// Locate finds the source holding the vault (by host), the workspace or
+// the repo (by its remote).
 func (p *Provider) Locate(ctx context.Context, host string) (string, bool, error) {
 	if err := p.wait(ctx); err != nil {
 		return "", false, err
 	}
 	for _, src := range p.sources {
-		if p.kind == provider.KindDatabricks && src.Detail == host {
+		if (p.kind == provider.KindDatabricks || p.kind == provider.KindRepo) && strings.EqualFold(src.Detail, host) {
 			return src.ID, true, nil
 		}
 		for _, c := range p.containers[src.ID] {