Function ensure_key_for_write 

pub fn ensure_key_for_write() -> SshCliResult<(Option<[u8; 32]>, KeySource)>

Ensures a key for write: loads existing or auto-creates secrets.key (unless plaintext opt-out).

Errors

Returns an error if auto-creating secrets.key fails when encryption is required.