test: mock the OS keyring in the cli package TestMain

The cli package's TestMain never routed go-keyring to its in-memory mock,
unlike the auth subpackage. The default tokenstore backend is the real OS
keychain, so any cli test that reaches a credential path without
UseFileBackendForTesting — or runs in the window after such a test restores
the global backend — would read the developer's real keychain and trigger a
macOS unlock prompt during `mise run test:ci`.

Call keyring.MockInit() once in TestMain so no cli test can touch the real
keychain, mirroring cmd/entire/cli/auth's TestMain.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Entire-Checkpoint: eb9e9029effe

Author: Soph

cmd/entire/cli/global_test.go

@@ -7,9 +7,18 @@ import (
 
 	"github.com/go-git/go-git/v6/x/plugin"
 	"github.com/go-git/go-git/v6/x/plugin/config"
+	"github.com/zalando/go-keyring"
 )
 
 func TestMain(m *testing.M) {
+	// Route the OS keyring to an in-memory mock for the whole package. The
+	// default tokenstore backend is the real OS keychain, so any test that
+	// reaches a credential path without UseFileBackendForTesting — or in the
+	// window after such a test restores the backend — would otherwise read the
+	// developer's real keychain and trigger a macOS unlock prompt. Mirrors the
+	// auth subpackage's TestMain.
+	keyring.MockInit()
+
 	// Register a default ConfigSource so tests that call ConfigScoped
 	// (directly or indirectly via Commit/CreateTag) don't fail with
 	// "no config loader registered".