tools/secrets.sh: EXIT trap must return 0

scrub() ended in `[ -n "$WD" ] && { ... }`. As an EXIT trap, its status becomes the
script's status, so with WD unset every read-only command exited 1 while printing the correct
answer. Callers saw a silent false failure — tests/run.sh reported 'could not read
tailscale_authkey' having successfully read it.

tools/secrets.sh

@@ -59,7 +59,16 @@ install_encrypted() {
 }
 
 workdir() { local d; d=$(mktemp -d "$DIR/.work.XXXXXX"); chmod 700 "$d"; echo "$d"; }
-scrub() { [ -n "${WD:-}" ] && { find "$WD" -type f -exec shred -u {} + 2>/dev/null || true; rm -rf "$WD"; }; }
+# NB: must return 0. As an EXIT trap its status becomes the script's status, and an
+# `[ -n "$WD" ] && ...` that is simply false would make every read-only command (get/list/verify)
+# exit 1 while printing a perfectly correct answer — a silent false failure in callers.
+scrub() {
+  if [ -n "${WD:-}" ]; then
+    find "$WD" -type f -exec shred -u {} + 2>/dev/null || true
+    rm -rf "$WD"
+  fi
+  return 0
+}
 trap scrub EXIT
 
 have_sops