feat: pick the share key in Go to, or by reference

Sharing without share.key opens Go to as a picker of secrets instead
of asking for a link: it lists only secrets, enter picks one, and a
pasted reference picks it too. The key, there and in share.key or
--key, can be a secret's lazysecrets:// link, Key Vault URL or
@Microsoft.KeyVault(...) reference.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/share/share_test.go

@@ -63,7 +63,7 @@ func TestSealRefuses(t *testing.T) {
 		want  string
 	}{
 		"short key":    {Header{Key: key}, []byte("short"), ok, "at least 16"},
-		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "secret's link"},
+		"vault as key": {Header{Key: ref.Ref{Kind: provider.KindAzure, Host: "kv.vault.azure.net"}}, pass, ok, "isn't a secret"},
 		"no files":     {Header{Key: key}, pass, nil, "no files"},
 		"not env":      {Header{Key: key}, pass, []File{{Path: "main.go", Data: []byte("x")}}, "isn't an env file"},
 		"escapes":      {Header{Key: key}, pass, []File{{Path: "../.env", Data: []byte("x")}}, "inside a repo"},
@@ -168,6 +168,29 @@ func TestPlanSymlinks(t *testing.T) {
 	}
 }
 
+func TestParseKey(t *testing.T) {
+	for _, s := range []string{
+		"lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share",
+		"https://kv-team.vault.azure.net/secrets/env-share",
+		"@Microsoft.KeyVault(VaultName=kv-team;SecretName=env-share)",
+		"lazysecrets://databricks/adb-1.1.azuredatabricks.net/team/env-share",
+	} {
+		if k, err := ParseKey(s); err != nil || k.Name != "env-share" {
+			t.Errorf("%s: %+v, %v", s, k, err)
+		}
+	}
+	for s, want := range map[string]string{
+		"{{secrets/team/env-share}}":                  "names no workspace",
+		"https://kv-team.vault.azure.net/keys/sops":   "isn't a secret",
+		"https://kv-team.vault.azure.net/":            "isn't a secret",
+		"lazysecrets://azure/subscriptions/0000-1111": "isn't a secret",
+	} {
+		if _, err := ParseKey(s); err == nil || !strings.Contains(err.Error(), want) {
+			t.Errorf("%s: %v, want %q", s, err, want)
+		}
+	}
+}
+
 func TestDefaultKey(t *testing.T) {
 	dir := t.TempDir()
 	general := "lazysecrets://azure/kv-team.vault.azure.net/secrets/env-share"