fix: preserve primary keystore errors on legacy fallback

[Peter7896]

Summary

• extract CLI and engine legacy-keystore retry logic into a shared helper
• preserve the original default-credential failure when the legacy retry also fails
• add regression tests for success, retry, disabled fallback, and double-failure paths

Testing

• git diff --check
• ./gradlew.bat --console plain test --tests app.morphe.engine.util.KeystoreSignerTest (blocked locally: GitHub Packages dependencies returned 401 Unauthorized with the current CLI token scope)

Fixes #158

[prateek-who]

#158 is already fixed from our side no? Pretty sure this does not do anything to close that issue. Also, this PR only extracts the logic to a common helper and adds a bunch of tests. I am sorry to ask this, but did you test anything in here? I went through your profile and it all seems like an AI commit spree. Do you have any interaction with whatever you have written here? I don't mind using AI to write stuff but I don't think you have any clue as to what it does?

blocked locally: GitHub Packages dependencies returned 401 Unauthorized with the current CLI token scope, you can literally create a PAT and this issue wouldn't happen.

[LisoUseInAIKyrios]

This issue is already fixed on stable.

This PR and the user profile appears to be entirely AI generated.