CredentialManagerVault now derives a scope from GcloPaths.DataRoot: the default
root keeps the unscoped "gclo:account:<id>" names (existing entries stay valid),
any other root (GCLO_DATA_DIR: the UI suite, portable setups) uses
"gclo:<16-hex sha256 of the normalized path>:account:<id>". The app and the CLI
both construct the vault through the default constructor, so they agree.
Before this, every FlaUI session on a developer machine with a saved default
token started Quick Sync pre-filled with that real token and did a real GitHub
organization lookup. AppSession now snapshots, at launch, whether a token was
entered before any test typed one, and the fresh-data-dir smoke test asserts it
was not. Tests: scope derivation (default = null, case/trailing-separator
insensitive, stable hash) and a real-store check that scoped and unscoped
entries do not see each other. SECURITY.md documents the scoped target name.
Closes#60
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
