feat: pick the share key in Go to, or by reference

Sharing without share.key opens Go to as a picker of secrets instead
of asking for a link: it lists only secrets, enter picks one, and a
pasted reference picks it too. The key, there and in share.key or
--key, can be a secret's lazysecrets:// link, Key Vault URL or
@Microsoft.KeyVault(...) reference.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share.go

@@ -87,8 +87,8 @@ type file struct {
 
 // Seal encrypts files with key, the value of h.Key, into a share link.
 func Seal(h Header, key []byte, files []File) (ref.Ref, error) {
-	if h.Key.IsShare() || h.Key.IsSource() || h.Key.IsContainer() {
-		return ref.Ref{}, errors.New("the key must be a secret's link")
+	if _, err := ParseKey(h.Key.String()); err != nil {
+		return ref.Ref{}, fmt.Errorf("the key: %w", err)
 	}
 	if len(key) < MinKey {
 		return ref.Ref{}, fmt.Errorf("the key's value is %d characters: use a random one of at least %d", len(key), MinKey)
@@ -248,14 +248,18 @@ func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	return key, true, nil
 }
 
-// ParseKey reads a key's link: a link to a secret.
-func ParseKey(link string) (ref.Ref, error) {
-	key, err := ref.Parse(link)
+// ParseKey reads which secret is the key: its lazysecrets:// link, Key
+// Vault URL or @Microsoft.KeyVault(...) reference.
+func ParseKey(s string) (ref.Ref, error) {
+	key, err := ref.Parse(s)
 	if err != nil {
 		return ref.Ref{}, err
 	}
-	if key.IsShare() || key.IsSource() || key.IsContainer() {
-		return ref.Ref{}, fmt.Errorf("%s isn't a secret's link", link)
+	switch {
+	case key.IsShare() || key.IsSource() || key.IsContainer() || (key.Type != "" && key.Type != provider.TypeSecret):
+		return ref.Ref{}, fmt.Errorf("%s isn't a secret", s)
+	case key.Kind == provider.KindDatabricks && key.Host == "":
+		return ref.Ref{}, fmt.Errorf("%s names no workspace: use its lazysecrets:// link", s)
 	}
 	return key, nil
 }

internal/share/share_test.go

@@ -63,7 +63,7 @@ func TestSealRefuses(t *testing.T) {
 		want  string
 	}{
 		"short key":    {Header{Key: key}, []byte("short"), ok, "at least 16"},
-		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "secret's link"},
+		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "isn't a secret"},
 		"no files":     {Header{Key: key}, pass, nil, "no files"},
 		"not env":      {Header{Key: key}, pass, []File{{Path: "main.go", Data: []byte("x")}}, "isn't an env file"},
 		"escapes":      {Header{Key: key}, pass, []File{{Path: "../.env", Data: []byte("x")}}, "inside a repo"},
@@ -168,6 +168,29 @@ func TestPlanSymlinks(t *testing.T) {
 	}
 }
 
+func TestParseKey(t *testing.T) {
+	for _, s := range []string{
+		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share",
+		"https://kv-team.vault.azure.net/secrets/env-share",
+		"@Microsoft.KeyVault(VaultName=kv-team;SecretName=env-share)",
+		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share",
+	} {
+		if k, err := ParseKey(s); err != nil || k.Name != "env-share" {
+			t.Errorf("%s: %+v, %v", s, k, err)
+		}
+	}
+	for s, want := range map[string]string{
+		"{{secrets/team/env-share}}":                  "names no workspace",
+		"https://kv-team.vault.azure.net/keys/sops":   "isn't a secret",
+		"https://kv-team.vault.azure.net/":            "isn't a secret",
+		"lazysecrets://azure/subscriptions/0000-1111": "isn't a secret",
+	} {
+		if _, err := ParseKey(s); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", s, err, want)
+		}
+	}
+}
+
 func TestDefaultKey(t *testing.T) {
 	dir := t.TempDir()
 	general := "lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share"