feat: the key picker says what sharing does, and skips plain env values

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/ui/app/sharefiles_test.go

@@ -47,6 +47,14 @@ func shareFrom(t *testing.T, root string, paste bool) string {
 	if v == nil || v.pick == nil {
 		t.Fatalf("no secret picker: %s", d.m.flash.text)
 	}
+	for _, o := range v.shown {
+		if o.plain || strings.Contains(o.label, ".env") {
+			t.Errorf("a plain env value offered as the key: %s", o.label)
+		}
+	}
+	if !strings.Contains(d.screen(), "as an encrypted link") {
+		t.Errorf("doesn't say what picking does:\n%s", d.screen())
+	}
 	if paste {
 		// A reference pasted is picked as it is.
 		d.send(tea.PasteMsg{Content: "https://" + kv + "/secrets/db-password"})