test: pre-cache symkey for every account in setup (op-4b7)

[jeremyschlatter-intern]

Summary

Fixes a flake in TestE2E_Migrated where parallel subtests surfaced errors like Error: no account configured (run 'opcli signin' first) or Error: account not found: my, despite those credentials having been stored in setup.

Un-namespaced resource (the root cause)

All of TestE2E_Migrated's subtests share one env (one tmpDir, one keychainService = \"opcli-test-<tmpDir>\", one shared keychain credential entry). The keychain entry is namespaced per-env, but the entry itself is concurrently written to by parallel subtests — that's the un-namespaced concurrency pattern.

The concurrent writes come from SetCachedSymKey. Whenever a subtest is the first to touch an account, newAccountKeychain derives the symmetric key (PBKDF2, expensive) and writes the result back into the credential store so subsequent invocations can skip the derivation. Under the migrated path every subprocess is slow (per-invocation v5→v61 in-memory migration), so one writer overlaps with many concurrent readers. Against a legacy ACL-protected Apple Keychain item, those overlaps surface as transient OSStatus values — verified via stress-repro CI traces:

• -25300 errSecItemNotFound on keychainGet (entry briefly "not found" during a peer's write)
• -67701 on keychainGet (under write contention)
• -25299 errSecDuplicateItem on keychainSet

Any non-zero status from the credential-store load propagates up as Error: account not found: <sh> (for OP_ACCOUNT branches) or Error: no account configured (for default-account branches) — exactly the flake symptom.

Fix

setupTestEnv already issued one verify read (op://Private/Test Login/password), which primed the my account's symkey. Iterate every testDB.Accounts and verify-read a field from the first readable vault item we find, so work (and any future account) is primed too. After this, the parallel subtest workload against the shared keychain entry is read-only — there is nothing for the reads to race against, and the OS-level transient-error surface disappears.

This is the minimal targeted fix the bead called for — no refactor of the test framework or of keychainSet itself. Related: op-xev.3 (PR #6) atomized writes; this PR eliminates writes during the stress window.

Test plan

• Added temporary stress job (go test -run TestE2E_Migrated -count=100 ./...) and watched it pass on CI (3min, 0 failures). Before the fix, -count=30 and -count=50 stress runs failed within a few iterations. Temporary stress job removed from this PR before review.
• make test in normal CI passes.

🤖 Generated with Claude Code