refactor: tidy up sharing after the round of tweaks

- Go to's picker settings are one picker struct, set while picking.
- Opening a share link plans the save, then asks or saves; no more
  offerWrite doing either by a flag.
- Closing the picker while it encrypts cancels the share, and a
  second pick meanwhile is ignored.
- Favourites and Recent leave out plain env values as keys too.
- share.key in the config is checked with share.ParseKey, so
  {{secrets/…}} is refused there already.
- A key that can't be read reads the same opening as sharing
  ("can't use …"); KeyError moved to share.go, maxFiles is
  maxUnpacked (bytes), and a stray comment is gone.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -14,7 +14,7 @@ import (
 	"go.yaml.in/yaml/v3"
 
 	"git.kebcloud.no/keb/lazysecrets/internal/commands"
-	"git.kebcloud.no/keb/lazysecrets/internal/ref"
+	"git.kebcloud.no/keb/lazysecrets/internal/share"
 	"git.kebcloud.no/keb/lazysecrets/internal/update"
 )
 
@@ -242,8 +242,8 @@ func (c Config) validate(path string) error {
 		}
 	}
 	if k := c.Share.Key; k != "" {
-		if r, err := ref.Parse(k); err != nil || r.IsShare() || r.IsSource() || r.IsContainer() {
-			return fmt.Errorf("%s: share.key: %q is not a secret's lazysecrets:// link, Key Vault URL or reference", path, k)
+		if _, err := share.ParseKey(k); err != nil {
+			return fmt.Errorf("%s: share.key: %w", path, err)
 		}
 	}
 	if n := c.Share.KeyRules.MinLength; n != 0 && n < 16 {

internal/config/config_test.go

@@ -73,6 +73,7 @@ func TestLoadRejectsMistakes(t *testing.T) {
 		"releases":   "releases: [git.example.com/team/lazysecrets]\n",
 		"http":       "releases: [http://git.example.com/team/lazysecrets]\n",
 		"share key":  "share:\n  key: https://kv.vault.azure.net/\n",
+		"workspace":  "share:\n  key: \"{{secrets/team/env-share}}\"\n",
 		"short keys": "share:\n  keyRules:\n    minLength: 8\n",
 		"classes":    "share:\n  keyRules:\n    minClasses: 5\n",
 	} {