feat: pick the share key in Go to, or by reference

Sharing without share.key opens Go to as a picker of secrets instead
of asking for a link: it lists only secrets, enter picks one, and a
pasted reference picks it too. The key, there and in share.key or
--key, can be a secret's lazysecrets:// link, Key Vault URL or
@Microsoft.KeyVault(...) reference.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share.go

@@ -87,8 +87,8 @@ type file struct {
 
 // Seal encrypts files with key, the value of h.Key, into a share link.
 func Seal(h Header, key []byte, files []File) (ref.Ref, error) {
-	if h.Key.IsShare() || h.Key.IsSource() || h.Key.IsContainer() {
-		return ref.Ref{}, errors.New("the key must be a secret's link")
+	if _, err := ParseKey(h.Key.String()); err != nil {
+		return ref.Ref{}, fmt.Errorf("the key: %w", err)
 	}
 	if len(key) < MinKey {
 		return ref.Ref{}, fmt.Errorf("the key's value is %d characters: use a random one of at least %d", len(key), MinKey)
@@ -248,14 +248,18 @@ func DefaultKey(root, general string) (key ref.Ref, ok bool, err error) {
 	return key, true, nil
 }
 
-// ParseKey reads a key's link: a link to a secret.
-func ParseKey(link string) (ref.Ref, error) {
-	key, err := ref.Parse(link)
+// ParseKey reads which secret is the key: its lazysecrets:// link, Key
+// Vault URL or @Microsoft.KeyVault(...) reference.
+func ParseKey(s string) (ref.Ref, error) {
+	key, err := ref.Parse(s)
 	if err != nil {
 		return ref.Ref{}, err
 	}
-	if key.IsShare() || key.IsSource() || key.IsContainer() {
-		return ref.Ref{}, fmt.Errorf("%s isn't a secret's link", link)
+	switch {
+	case key.IsShare() || key.IsSource() || key.IsContainer() || (key.Type != "" && key.Type != provider.TypeSecret):
+		return ref.Ref{}, fmt.Errorf("%s isn't a secret", s)
+	case key.Kind == provider.KindDatabricks && key.Host == "":
+		return ref.Ref{}, fmt.Errorf("%s names no workspace: use its lazysecrets:// link", s)
 	}
 	return key, nil
 }