Per user mandate "95% across all repos without any exception".
Refactors Execute() and main() to extract testable inner functions;
mocks keychain provider via injectable interface; covers login polling
via httptest. Coverage: 77.7% -> 95.1%.

Production refactors (behavior-preserving):
- cmd.Execute() -> thin wrapper around ExecuteWithArgs(os.Args[1:])
- main() -> os.Exit(run(args, stderr)); run() is the testable inner fn
- secretstore.keychainBackend uses an injectable keyringProvider interface
  (realKeyring for prod, fakeKeyring for tests)
- pollInterval/pollTimeout/tierUpgradeTimeout are var (not const) so
  tests can compress them to milliseconds

New test files (13):
- main_test.go (run() exit-code translation)
- cmd/execute_test.go (Execute / ExecuteWithArgs / SetBuildInfo)
- cmd/login_poll_test.go (createCLISession, pollForAuthCompletion,
  pollForTierUpgrade, loadAnonymousTokens, openBrowser, runUpgrade)
- cmd/login_timeout_test.go (timeout/retry branches via short pollInterval)
- cmd/extras_test.go (runResourceDetail + runResourceDelete branches)
- cmd/up_helpers_test.go (truncate, apiResourceType, webhookReceiveURL,
  haveAuth, validate, readManifest, findExisting)
- cmd/coverage_push95_test.go (errors.go, json_error.go, apierror.go,
  discover.go matchResourceFilters, deploy_stub.go branches, initConfig)
- cmd/coverage_final_test.go (Execute, ExitCodeFor, wrapJSONErr,
  fetchCredentials, fetchExistingResources, provisionForUp branches)
- cmd/coverage_tail_test.go (jsonModeOn os.Args fallback, runResources
  filter/limit/JSON/error branches)
- cmd/coverage_provision_test.go (provisionResource error branches)
- internal/secretstore/keychain_fake_test.go (full keychainBackend
  wrapping logic via fakeKeyring; realKeyring smoke test)
- internal/cliconfig/cliconfig_extra_test.go + cliconfig_more_test.go
  (SecretBackendName branches, malformed JSON, fallback path, write errors)
- internal/tokens/store_extra_test.go (malformed JSON, homedir errors,
  bad path)

CLI behavior preserved: `instant --help`, `instant --version`, all
existing integration tests pass.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>