Remove the Entire DB credential-store integration · Entire

Review of Code Changes

Review the code changes against the base branch 'main'. The merge base commit for this comparison is 368750cee35f31935640a34ad199e889fc60f1a8. Run git diff 368750cee35f31935640a34ad199e889fc60f1a8 to inspect the changes relative to main. Provide prioritized, actionable findings.

Findings

1. Finding Title: [P2] Use a real lock for Windows writes
   Body: When ENTIRE_TOKEN_STORE=file is used on Windows, these functions only open the .lock file and do not serialize concurrent WriteStoredToken calls. writeFileToken relies on the exclusive lock while it rereads, writes the shared path + ".tmp", and renames it, so two processes can race and either lose one token update or fail the rename; use Windows file locking rather than a no-op fallback.
   Confidence Score: 0.86
   Priority: 2
   Code Location: /Users/soph/Work/entire/devenv/git-sync/internal/auth/tokenstore_lock_windows.go, Lines 19-20

Overall Findings

• Overall Correctness: patch is incorrect
• Overall Explanation: The patch fixes Windows compilation, but the Windows implementation does not provide the locking semantics that the token store write path depends on, leaving concurrent file-store updates unsafe on that platform.
• Overall Confidence Score: 0.82

Commit Details

Commit Message: Remove the Entire DB credential-store integration
git-sync carried a bespoke Entire credential path: auth.Resolve fell back to an active-user lookup in ~/.config/entire/hosts.json plus a file/keyring token store and OAuth refresh-token handling (client_id=entire-cli). Nothing in the product produces that layout anymore — the mirror-pipeline worker (the only library consumer that talks to entiredb) supplies credentials directly at the transport layer (GitHub installation tokens + per-request entire-core repo-scoped bearers), and client-side entire:// auth is owned by the separate git-remote-entire helper using the newer contexts.json model. So the lookup only ever read a store no current producer writes.

Drop entiredb.go and tokenstore.go and the LookupEntireDBCredential fallback; auth.Resolve now resolves explicit token/bearer credentials only and otherwise returns nil so the git credential helper is consulted on a 401, exactly as for any other remote. This also drops the github.com/zalando/go-keyring dependency and, with the file token store gone, removes the syscall.Flock usage that broke the Windows build (so the package now cross-compiles for windows cleanly).

Supersedes the entiredb token-refresh fix (#90) and the tokenstore Windows flock fix (#92), both of which were polishing this now-deleted code.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com Entire-Checkpoint: de15fe82f1f3+18/-1384