## Why
Saving local secrets invalidated the decrypted cache, forcing the next read to decrypt contents already available in memory.
## What changed
Populate the cache with the saved snapshot after the atomic write succeeds. Only cache the current schema version, leaving normalization and rejection of other versions to the read path. Reads continue to verify the ciphertext and keyring before reusing cached contents.
## Testing
Add coverage across all four local secrets namespaces for cache reuse after saving, including through backend clones, and preservation of the committed snapshot after a failed write. Update existing tests to verify cache reuse after setting and deleting secrets while retaining concurrent cold-read coverage.
GitOrigin-RevId: 61519aadc16bbe8db8c5055b126885500716418a
## Why
Repeated reads of Codex auth and managed secrets repeat expensive scrypt decryption even when the encrypted file and keyring passphrase are unchanged.
## What changed
Extend the decrypted snapshot cache to `CodexAuth` and `ManagedSecrets`, keeping at most one snapshot per namespace. Reuse snapshots only when the file path, ciphertext, and passphrase match, and invalidate matching snapshots on writes. Every read still checks the file and keyring before reusing plaintext.
## Testing
Extend cache tests to cover concurrent reuse, writes, external file replacement, file removal, key rotation, keyring errors, invalid ciphertext, and isolation across homes and namespaces. Prime the auth cache before verifying fallback when the keyring fails.
GitOrigin-RevId: eaf802ef4cfdbe482b56423807a1fe0fe3def2cd
Celia Chen