feat: the key picker says what sharing does, and skips plain env values

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/searchview.go

@@ -56,8 +56,9 @@ type searchView struct {
 	// pick, if set, makes Go to a picker of secrets, for title: it lists
 	// secrets only, and enter gives the selected one's link to pick
 	// instead of going there.
-	pick                func(m *Model, r ref.Ref) tea.Cmd
-	pickTitle, pickNote string
+	pick      func(m *Model, r ref.Ref) tea.Cmd
+	pickTitle string
+	pickLines []string // what picking does, above the input
 
 	// loaded are the scopes a search has loaded since the popup opened:
 	// typing loads the scope once, so lists that fail aren't asked for
@@ -749,7 +750,14 @@ func (m Model) searchViewBox() string {
 		lists = panes.BoxCounted(m.st, title(resultsTitle, true), "", counter(v.res, len(v.shown)), right, resW, listH, focused)
 	}
 
-	body := []string{" " + v.input.View(), ""}
+	var body []string
+	if v.pick != nil {
+		for _, l := range v.pickLines {
+			body = append(body, " "+l)
+		}
+		body = append(body, "")
+	}
+	body = append(body, " "+v.input.View(), "")
 	for _, l := range strings.Split(lists, "\n") {
 		body = append(body, " "+l)
 	}
@@ -761,9 +769,6 @@ func (m Model) searchViewBox() string {
 	} else {
 		body = append(body, "") // the same height on every tab
 	}
-	if v.pick != nil && v.pickNote != "" {
-		body = append(body, " "+m.st.Muted.Render(v.pickNote))
-	}
 	km := m.keys
 	var foot string
 	switch {
@@ -808,10 +813,10 @@ func (v *searchView) selectLabel() string {
 }
 
 // pickable is the link of a Go to entry that a picker can pick: a
-// secret (not a key or certificate).
+// secret (not a key or certificate, nor a key in a plain env file).
 func pickable(o option) (ref.Ref, bool) {
 	r, err := ref.Parse(o.star)
-	if err != nil || r.IsShare() || r.IsSource() || r.IsContainer() || (r.Type != "" && r.Type != provider.TypeSecret) {
+	if err != nil || o.plain || r.IsShare() || r.IsSource() || r.IsContainer() || (r.Type != "" && r.Type != provider.TypeSecret) {
 		return ref.Ref{}, false
 	}
 	return r, true