test: mock the OS keyring in the cli package TestMain

The cli package's TestMain never routed go-keyring to its in-memory mock, unlike the auth subpackage. The default tokenstore backend is the real OS keychain, so any cli test that reaches a credential path without UseFileBackendForTesting — or runs in the window after such a test restores the global backend — would read the developer's real keychain and trigger a macOS unlock prompt during mise run test:ci.

Call keyring.MockInit() once in TestMain so no cli test can touch the real keychain, mirroring cmd/entire/cli/auth's TestMain.