[margani]

Closes #93.

What changed and why

In LytronHQ/nabz-internal, 3 of about 12 CI runs that read Bitwarden failed on the first attempt with bws could not read project … : Error:, and each rerun minutes later passed. The reason was hidden: bws prints Error: on its first line and the cause on the following ones, and action_env kept only head -1.

• --attempts <n> (default 3) and --retry-wait <seconds> (default 3, doubled before each later try): a failed read is retried, and each retry is reported on stderr.
• The final error carries bws's whole output on one line, capped at 600 characters.
• fake-bws can fail its next N calls with a multi-line error shaped like the real one (Error: / blank / 0: Received error message from server: [429 …]).
• README: the two flags.

How it was verified

• bash secrets/tests/secrets_test.sh → PASS. New checks: two transient failures then success succeeds, after exactly 2 failed tries, and the retry is reported. A lasting failure stops after exactly 3 tries (--attempts default) and after 2 with --attempts 2, and the message contains 429 Too Many Requests from bws's third line. Bad values for both flags are refused.
• Mutation tests. Restoring head -1: FAIL: … expected '429 Too Many Requests'. A single try: FAIL: two transient failures then success should succeed.
• ./run-tests → all 10 passed, 3 skipped (the skips are Windows-only and the disposable-machine harden test).

Not verified

• The real cause of the nabz failures. This change makes the next one show it, and retries let it recover. Whether it is Bitwarden's rate limit (the 429 in the fake is an assumption about its shape) will show in the first real failure's message.