fix(cmd_status): function-scope keys so the coverage/firmware build compiles

Rebasing onto current master pulled in a latent build break: cmd_status
declares `keys` inside the `if (commands_is_admin())` block but scrubs it
via `secure_wipe(keys, sizeof(keys))` at function scope, so `keys` is
undeclared there. asan_commands links serial/commands.c (not
commands_system.c) so it never compiled this TU, but `make -C test coverage`
compiles the whole first-party surface and fails here (`keys undeclared`) --
as does the real firmware build. Restore `keys` to function scope, matching
the scrub's intent of always clearing the key DB from BSS (incl. the
non-admin path where it stays zero-initialised). Same fix as PR hakierspejs#15 (M1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Claude

serial/commands_system.c

@@ -64,11 +64,13 @@ void cmd_status(int argc, char **argv) {
         printf("ntp:       not synced\r\n");
     }
 
-    // Keys (admin only: key inventory is target-selection data)
+    // Keys (admin only: key inventory is target-selection data). Declared at
+    // function scope so the scrub below always runs, even on the non-admin path
+    // where the array stays zero-initialised.
+    static key_record_t keys[BACKUP_MAX_KEYS];
     if (commands_is_admin()) {
-        static key_record_t keys[BACKUP_MAX_KEYS];
-        int                 count   = storage_key_list(keys, BACKUP_MAX_KEYS);
-        int                 enabled = 0, corrupt = 0;
+        int count   = storage_key_list(keys, BACKUP_MAX_KEYS);
+        int enabled = 0, corrupt = 0;
         for (int i = 0; i < count; i++) {
             if (!keys[i].is_checksum_valid)
                 corrupt++;