Linux CLI auth status panics when accessing Secret Service inside Tokio runtime

Trace cap::credentials::resolve_agent and cap::run from the reported stack trace, then inspect how keyring and Secret Service are accessed inside the Tokio runtime. Reproduce with cap auth status --json on Linux and verify that it returns status JSON or a handled credential error without panicking.

Description

On Linux, cap auth status --json panics while resolving the stored agent credential through Secret Service.

I expected the command to return its documented status JSON, or a handled credential error. Instead, it aborts with a nested Tokio runtime panic. This reproduces consistently with the bundled CLI. cap doctor --json reports "ok": true and "captureReady": true.

Reproduction

1. Use the Cap Desktop bundled CLI on Ubuntu 24.04 with GNOME on Wayland.

2. Run:

   cap auth status --json
   

3. The CLI panics before producing JSON.

Actual output

thread 'cap-cli-runtime' panicked at /home/runner/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.47.1/src/runtime/scheduler/multi_thread/mod.rs:86:9:
Cannot start a runtime from within a runtime. This happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.
stack backtrace:
   0: __rustc::rust_begin_unwind
   1: core::panicking::panic_fmt
   2: tokio::runtime::context::runtime::enter_runtime
   3: tokio::runtime::runtime::Runtime::block_on_inner
   4: zbus::utils::block_on
   5: secret_service::blocking::SecretService::connect
   6: zbus_secret_service_keyring_store::store::Store::new_internal
   7: keyring::v1::Entry::new
   8: cap::credentials::resolve_agent
   9: cap::run::{{closure}}
error: CLI runtime thread panicked

Additional Context

• Cap version: cap 0.1.0
• Distribution: bundled (/usr/bin/cap-cli, invoked through the Cap shim)
• Operating system: Ubuntu 24.04.5 LTS
• Kernel: Linux 6.8.0-139-generic x86_64
• Desktop/session: GNOME Classic, Wayland
• Architecture: x86_64

(Codex helped draft this)