refactor(keys): extract master-key package to top-level keys/

Master-key acquisition and the cross-host dump format are a concern distinct from the raw crypto primitives, so crypto/keyretriever moves to an importable top-level keys/. KeyRetriever→Retriever drops the keys.KeyRetriever stutter.

keys/static.go

@@ -0,0 +1,19 @@
+package keys
+
+// StaticRetriever returns pre-supplied key bytes (from a Dump) instead of platform retrieval, ignoring
+// Hints. An empty key returns (nil, nil) — the "tier not applicable" signal NewMasterKeys expects.
+type StaticRetriever struct {
+	key []byte
+}
+
+// NewStaticRetriever wraps key bytes; a nil/empty key yields a retriever that reports the tier unavailable.
+func NewStaticRetriever(key []byte) *StaticRetriever {
+	return &StaticRetriever{key: key}
+}
+
+func (p *StaticRetriever) RetrieveKey(_ Hints) ([]byte, error) {
+	if len(p.key) == 0 {
+		return nil, nil
+	}
+	return p.key, nil
+}