Handle stale Secret Service items without disrupting login

[hendrikmennen]

Problem

Some Flatpak users cannot restore their OneWare Cloud login because the host Secret Service contains a stale gnome-keyring item reference. The credential lookup logs:

GitCredentialManager.Interop.InteropException: Failed to open secret service session
 ---> System.Exception: No such secret item at path: /org/freedesktop/secrets/collection/login/13
   at GitCredentialManager.Interop.Linux.SecretServiceCollection.GetSecretService()
   at GitCredentialManager.Interop.Linux.SecretServiceCollection.Get(...)
   at OneWare.CloudIntegration.Services.OneWareCloudLoginService.GetRefreshToken(String userId)
   at OneWare.CloudIntegration.Services.OneWareCloudLoginService.RefreshFromUserIdAsync(String userId)

This only affects users whose host login keyring advertises an item path that no longer exists. The Flatpak permission is already correct: the manifest grants --talk-name=org.freedesktop.secrets.

The upstream cause matches GNOME/gnome-keyring#91. Devlooped.CredentialManager calls libsecret with collection loading enabled; libsecret encounters the stale item and reports the misleading session-opening failure.

Relevant code

• src/OneWare.CloudIntegration/Services/OneWareCloudLoginService.cs: GetRefreshToken, SaveCredentials, and Logout
• Credential-store call sites in src/OneWare.SourceControl
• build/props/Devlooped.CredentialManager.props currently pins version 2.7.0

Expected behavior

A broken or unavailable Secret Service should not disrupt application startup or the UI. OneWare should treat the stored refresh token as unavailable, log a useful diagnostic, and allow the user to authenticate again.

Acceptance criteria

• Secret Service failures during credential reads, writes, and deletion are handled consistently.
• Failed credential reads result in a signed-out/re-authentication state rather than an unhandled UI failure.
• The user receives an actionable message when secure credential storage is unavailable.
• No automatic fallback to plaintext credential storage is introduced.
• Unprotected credential-store calls in OneWare.SourceControl are covered as well.