feat: update action.yml to use pwsh shell and enhance vm.py with start option; add credential management scripts

src/ci_orchestrator/credentials.py

@@ -45,15 +45,27 @@ class KeyringCredentialStore:
                 "keyring is not installed; run `pip install keyring`."
             ) from exc
 
+        # 1. Native lookup — works on Windows Credential Manager and backends
+        #    that implement get_credential(service, username=None).
         cred = keyring.get_credential(target, None)
-        if cred is None:
-            # Fallback: some backends only support get_password and need the
-            # username to be the same as the target.
-            password = keyring.get_password(self._service, target)
-            if password is None:
-                raise KeyError(f"Credential '{target}' not found in keyring.")
+        if cred is not None:
+            return Credential(username=cred.username, password=cred.password)
+
+        # 2. Two-entry scheme for file backends (PlaintextKeyring, etc.) where
+        #    get_credential(target, None) is a no-op.  The username is stored
+        #    separately under service="{target}:meta", key="username".
+        username = keyring.get_password(f"{target}:meta", "username")
+        if username is not None:
+            password = keyring.get_password(target, username)
+            if password is not None:
+                return Credential(username=username, password=password)
+
+        # 3. Legacy fallback: password stored under service=self._service.
+        password = keyring.get_password(self._service, target)
+        if password is not None:
             return Credential(username=target, password=password)
-        return Credential(username=cred.username, password=cred.password)
+
+        raise KeyError(f"Credential '{target}' not found in keyring.")
 
 
 __all__ = ["Credential", "CredentialStore", "KeyringCredentialStore"]