Drop the retired keyring-unlock residue from ccebuild and docs

cce-display-manager retired the KeePassXC unlock chain (TPM-unlocked
gnome-keyring since 2026-08-29) and, in its own repo today, deleted the
three inert cce-keyring-unlock* binaries. Follow-ups here:

- ccebuild install-system: drop the two /usr/local/sbin pairs for the
  deleted binaries — with them gone from cargo metadata the guard
  'not built — run: ccebuild build' would fail every run.
- scripts/cce-keyring-selftest: remove this stray duplicate. The
  canonical copy lives in cce-display-manager (as crate_scripts()'s own
  comment says), and was rewritten today for the gnome-keyring design;
  the CCE_LOG runtime-dir improvement this copy carried moved with it.
  A leftover here would clobber the real one on any cce-compositor
  install, resurrecting the retired checks.
- WORKSPACE.md / comments: stop citing the keyring helpers in the
  present tense; the org.freedesktop.secrets dbus shadow now redirects
  to the TPM-unlocking unit, not KeePassXC.

Co-Authored-By: Claude Fable 5 <[email protected]>

 WORKSPACE.md                 |   4 +-
 scripts/cce-keyring-selftest | 113 -------------------------------------------
 scripts/ccebuild             |  11 ++---
 3 files changed, 7 insertions(+), 121 deletions(-)

diff --git a/WORKSPACE.md b/WORKSPACE.md
index 3ccc384..b591b6b 100644
--- a/WORKSPACE.md
+++ b/WORKSPACE.md
@@ -208,8 +208,8 @@ crates (~11s). Pick one shape and stay with it.
 
 Binary names do not reliably match the crate: `cce-fx` lives in `cce-compositor/`,
 `cce-system-interface` and `cce-files` declare explicit `[[bin]]` names, and several
-crates ship extra bins (`cce-ui` → `cce-ramp`/`cce-relief`, `cce-compositor` → `ccectl`,
-`cce-display-manager` → three keyring helpers). Ask cargo rather than guessing:
+crates ship extra bins (`cce-ui` → `cce-ramp`/`cce-relief`, `cce-compositor` →
+`ccectl`). Ask cargo rather than guessing:
 `cargo metadata --no-deps --format-version 1 | jq -r '.packages[].targets[] | select(.kind|index("bin")) | .name'`.
 
 ## The `cce-ui` toolkit (start here for any client work)
diff --git a/scripts/cce-keyring-selftest b/scripts/cce-keyring-selftest
deleted file mode 100755
index e1c749e..0000000
--- a/scripts/cce-keyring-selftest
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env bash
-# cce-keyring-selftest — did this login's keyring chain work?
-#
-# Written 2026-08-16 alongside the login-race fix (cce@9d454c4,
-# cce-display-manager@d7cc6ec/17bfb9d). Run it after logging in.
-#
-# Everything read here is scoped to the CURRENT session: the journal is durable
-# but queried from the compositor's start time, and the compositor log now
-# lives in the per-user runtime dir (moved out of /tmp in cce@522ce13), which
-# is cleared at logout. So run this before logging out — afterwards the log
-# half of the answer is simply gone. The /tmp fallback covers a session started
-# by a pre-move startcce.
-CCE_LOG="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/cce/cce.log"
-[ -f "$CCE_LOG" ] || CCE_LOG=/tmp/cce.log
-
-pass=0 fail=0
-ok()   { printf '  \033[32mPASS\033[0m  %s\n' "$1"; pass=$((pass+1)); }
-bad()  { printf '  \033[31mFAIL\033[0m  %s\n' "$1"; fail=$((fail+1)); }
-info() { printf '        %s\n' "$1"; }
-
-# Everything must be scoped to THIS login, not `journalctl -b`: one boot spans
-# many sessions here (the machine stays up for days), and boot-wide counts made
-# a healthy login look like 32 failed claude-desktop launches.
-#
-# Find the compositor by /proc/<pid>/exe basename, never comm or a pgrep
-# pattern: it is launched through the `cce` symlink, so its comm is "cce", but
-# a `make run` leftover has comm "cce-fx".
-compositor_pid() {
-    local p exe
-    for p in /proc/[0-9]*; do
-        exe=$(readlink "$p/exe" 2>/dev/null) || continue
-        exe=${exe% (deleted)}
-        [ "${exe##*/}" = cce-fx ] && { printf '%s\n' "${p#/proc/}"; return 0; }
-    done
-    return 1
-}
-
-if cce_pid=$(compositor_pid); then
-    SINCE=$(date -d "$(ps -o lstart= -p "$cce_pid")" '+%Y-%m-%d %H:%M:%S')
-else
-    SINCE=$(date -d '-10 minutes' '+%Y-%m-%d %H:%M:%S')
-fi
-jl() { journalctl --since "$SINCE" --no-pager "$@" 2>/dev/null; }
-
-echo "cce keyring self-test — session (compositor) started $SINCE"
-echo
-
-# 1. Is the Secret Service actually open right now?
-locked=$(busctl --user get-property org.freedesktop.secrets \
-    /org/freedesktop/secrets/aliases/default \
-    org.freedesktop.Secret.Collection Locked 2>/dev/null)
-[ "$locked" = "b false" ] && ok "keyring is unlocked" || bad "keyring is ${locked:-unreachable}"
-
-# 2. Did KeePassXC come up from its own unit rather than session restore?
-if systemctl --user is-active --quiet cce-keepassxc.service; then
-    ok "cce-keepassxc.service active"
-else
-    bad "cce-keepassxc.service not active"
-fi
-
-# 3. Unlock latency: KeePassXC start -> daemon confirmed. Was 46s pre-fix.
-uline=$(jl -u cce-keyring-unlockd.service | grep 'unlocked and verified' | tail -1)
-if [ -n "$uline" ]; then
-    # InactiveExit, not ActiveEnter: ExecStartPost does the unlocking, so the
-    # unit only reaches "active" AFTER the unlock — measuring from ActiveEnter
-    # reports a negative latency.
-    kstart=$(systemctl --user show cce-keepassxc.service -p InactiveExitTimestamp --value)
-    utime=$(printf '%s\n' "$uline" | awk '{print $1, $2, $3}')
-    if [ -n "$kstart" ]; then
-        secs=$(( $(date -d "$utime" +%s) - $(date -d "$(printf '%s' "$kstart" | cut -d' ' -f2-3)" +%s) ))
-        info "unlocked ${secs}s after KeePassXC started (was 46s before the fix)"
-    fi
-    ok "keyring unlock confirmed this session"
-else
-    bad "no successful unlock recorded this session"
-fi
-
-# 4. Did the compositor barrier engage, and for how long?
-bline=$(grep -h -E 'Keyring (unlocked after|still locked)|No Secret Service' "$CCE_LOG" 2>/dev/null | tail -1)
-case "$bline" in
-    *"Keyring unlocked after"*) ok "barrier released: ${bline##*] }" ;;
-    *"still locked"*)           bad "barrier hit its timeout: ${bline##*] }" ;;
-    *"No Secret Service"*)      bad "no Secret Service seen: ${bline##*] }" ;;
-    *) info "no barrier line in $CCE_LOG (no gated app restored?)" ;;
-esac
-
-# 5. The actual question: is claude-desktop alive and loaded? The failing one
-#    died at 73MB; a working one is hundreds of MB.
-mainpid=$(pgrep -f 'claude-desktop --password-store' | head -1)
-if [ -n "$mainpid" ]; then
-    rss=$(awk '/VmRSS/{print $2}' "/proc/$mainpid/status" 2>/dev/null)
-    rssmb=$(( ${rss:-0} / 1024 ))
-    if [ "$rssmb" -gt 300 ]; then
-        ok "claude-desktop running and loaded (${rssmb}MB, pid $mainpid)"
-    else
-        bad "claude-desktop running but only ${rssmb}MB — may be stalled on the keyring"
-    fi
-else
-    bad "claude-desktop not running"
-fi
-
-# 6. Did it need a relaunch? More than one launch this session = the restored
-#    one died and had to be started again by hand — the original symptom.
-scopes=$(jl --user | grep -c 'Started app-claude-desktop-.*\.scope')
-if [ "$scopes" -le 1 ]; then
-    ok "claude-desktop started once this session ($scopes launch)"
-else
-    bad "claude-desktop launched $scopes times this session — first attempt(s) died"
-fi
-
-echo
-printf '%d passed, %d failed\n' "$pass" "$fail"
-[ "$fail" -eq 0 ]
diff --git a/scripts/ccebuild b/scripts/ccebuild
index a993e8f..b0edc4f 100755
--- a/scripts/ccebuild
+++ b/scripts/ccebuild
@@ -18,9 +18,9 @@ EXCLUDE=(vk-smoke)
 # installed here.
 #
 # Classified per FILE, from the unit's own [Install] WantedBy, because a crate
-# can legitimately ship both: cce-display-manager has the root unlock daemon
-# (multi-user.target) next to the per-session unlock client and KeePassXC units
-# (graphical-session.target). The old per-crate exclusion list swallowed the
+# can legitimately ship both: cce-display-manager once had the root unlock
+# daemon (multi-user.target) next to the per-session unlock client and KeePassXC
+# units (graphical-session.target). The old per-crate exclusion list swallowed the
 # whole crate, so its user units silently never installed — the same
 # hand-maintained-list failure this script exists to avoid. Matching is exact:
 # graphical.target and graphical-session.target are different targets.
@@ -189,7 +189,8 @@ crate_scripts() {
 # D-Bus activation files a crate ships in its dbus/ dir, installed to
 # ~/.local/share/dbus-1/services where they shadow /usr/share ones by basename
 # (that shadowing is the mechanism: org.freedesktop.secrets.service overrides
-# gnome-keyring's with KeePassXC's unit). Same .service extension as systemd
+# the stock gnome-keyring activation with the TPM-unlocking unit's). Same
+# .service extension as systemd
 # units, but user_units() cannot mistake one for a unit: it keys on [Install]
 # WantedBy, which D-Bus files don't have.
 dbus_services() {
@@ -629,8 +630,6 @@ cmd_install_system() {
     fi
     local pairs=(
         "cce-display-manager:/usr/bin/cce-display-manager"
-        "cce-keyring-unlockd:/usr/local/sbin/cce-keyring-unlockd"
-        "cce-keyring-unlock-setup:/usr/local/sbin/cce-keyring-unlock-setup"
     )
     local entry bin dest
     for entry in "${pairs[@]}"; do