What if kontext runs under the same user as Claude? Could it in principle inspect the kontext process and extract the key from memory?

If they use the system keyring, it depends on the OS and other details - MacOS, Linux, and Windows all have different implementation tradeoffs.