- Add cmd/keys.go with six subcommands backed by the Plan 04 query layer
- keys list prints masked findings with id/provider/confidence/source columns
and supports --provider/--verified/--limit/--unmask filters
- keys show <id> renders a finding fully unmasked with verify metadata
- keys export --format=json|csv reuses the formatter registry, atomic
file writes when --output is set
- keys copy <id> uses atotto/clipboard for clipboard handoff
- keys delete <id> prompts via cmd.InOrStdin unless --yes is passed
- keys verify <id> gates on verify.EnsureConsent, then updates the stored
row inline via UPDATE findings SET verify_* using db.SQL()
- Remove the keysCmd stub from cmd/stubs.go (single declaration)
- All subcommands read config via openDBWithKey() mirroring scan.go
- main.go entry point (7 lines) delegates to cmd.Execute()
- cmd/root.go stub so go build ./... compiles (Plan 05 replaces)
- pkg/providers, pkg/storage, pkg/engine package stubs
- Test stubs with t.Skip() for providers, storage, engine packages
- testdata/samples: openai_key.txt, anthropic_key.txt, multiple_keys.txt, no_keys.txt
- go build ./... and go test ./... -short both exit 0
