feat: pick the share key in Go to, or by reference

Sharing without share.key opens Go to as a picker of secrets instead
of asking for a link: it lists only secrets, enter picks one, and a
pasted reference picks it too. The key, there and in share.key or
--key, can be a secret's lazysecrets:// link, Key Vault URL or
@Microsoft.KeyVault(...) reference.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/config/config.go

@@ -86,8 +86,9 @@ type LinkHandler struct {
 }
 
 type Share struct {
-	// Key is the link to the secret whose value encrypts shared files,
-	// for repos whose .lazysecrets.yaml doesn't name one.
+	// Key is the secret whose value encrypts shared files (its
+	// lazysecrets:// link, Key Vault URL or reference), for repos whose
+	// .lazysecrets.yaml doesn't name one.
 	Key string `yaml:"key"`
 }
 
@@ -232,7 +233,7 @@ func (c Config) validate(path string) error {
 	}
 	if k := c.Share.Key; k != "" {
 		if r, err := ref.Parse(k); err != nil || r.IsShare() || r.IsSource() || r.IsContainer() {
-			return fmt.Errorf("%s: share.key: %q is not a lazysecrets:// link to a secret", path, k)
+			return fmt.Errorf("%s: share.key: %q is not a secret's lazysecrets:// link, Key Vault URL or reference", path, k)
 		}
 	}
 	for i, v := range c.Providers.Azure.Vaults {