test: isolate secret rotation CLI fixtures

[bifrost0x]

What changed

• stop the offline-confirmation test from copying the runtime SECRET_KEY into a temporary file
• isolate the successful rotation CLI test with fixed test-only key material via monkeypatch

Why

CodeQL alerts 6 and 7 traced config.SECRET_KEY into temporary files created by two tests. The production secret-rotation implementation was not involved in either sink, so the fix removes the unnecessary test coupling without changing production encryption, persistence, or permissions.

Validation

• pytest tests/test_secret_rotation.py -q: 13 passed
• pytest tests -q on Python 3.14: 1243 passed, 33 skipped
• git diff --check

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c12427095e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve an existing secret in the offline-ack test

Keep a fixed test-only secret file here and assert that its contents remain unchanged. With the directory initially empty, this test only proves that omitting --confirm-offline does not create a secret; if a future regression overwrites or deletes an already-persisted production secret before rejecting the command, the test will still pass, whereas the previous assertion covered that important no-side-effects contract.

Useful? React with 👍 / 👎.