Add pinentry-based trusted value entry for `set` and `check`, and
require explicit human approval before releasing secrets.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add an `egui-pinentry` crate: a passphrase and confirmation dialog drawn
with egui rasterized on the CPU (no GPU, no OpenGL/Vulkan) via softbuffer,
with an X11 keyboard grab released via a Drop guard, keystrokes fed into a
zeroizing buffer (no egui TextEdit undo retention), and a `SecretString`
result. One event loop is reused across dialogs. The dialog layout is
covered by headless egui_kittest tests. devenv gains the windowing libs on
LD_LIBRARY_PATH so it runs inside the dev shell.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…oval policy

Drop the per-secret `interactive` flag and the `set --ask` flag. `set` and the
`check` fill loop now detect whether this machine can show a GUI prompt (a
display server plus a dialog to draw with: the built-in one, or a pinentry
binary without the `gui-prompt` feature) and prefer it over reading the console
whenever it can.

This forces a precedence choice the opt-in used to sidestep, since a non-terminal
stdin means both "a script is piping a value" and "an agent invoked me with a pipe
it controls". Resolved toward the security property: inline values win, then the
GUI prompt, then a terminal prompt, then a piped stdin. On a machine with a
display, `echo v | secretspec set KEY` now opens a dialog rather than storing `v`;
pass the value inline to seed a secret from a script.

When detection sees a display but the dialog cannot open on it and there is no
controlling terminal either, fail closed with an actionable message rather than
fall back to the caller-controlled stdin.

Also let `require_approval` be set once for every project, as
`[defaults].require_approval` in the user's config, so an operator can ask to be
prompted whenever an agent releases secrets without editing each `secretspec.toml`.
The project and user policies combine by taking whichever is stricter
(`false` < `"agents"` < `true`), making this a floor rather than a fallback: a
project cannot switch off the approval an operator configured for themselves, and
an operator cannot switch off the approval a project demands of every clone. A
plain fallback would have let any project's explicit `require_approval = false`,
the default value, silently disable the operator's safeguard. `secretspec config
show` prints the user-level policy.

Correct the docs to describe the built-in GUI dialog rather than an external
pinentry binary, and to note that `require_approval` gates `import` alongside
`run` and `get`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ell evaluates

The LD_LIBRARY_PATH for egui-pinentry's X11/Wayland windowing stack referenced
wayland + xorg.* unconditionally. Those packages are Linux-only, so evaluating
the devenv shell on a darwin host aborted with "wayland is not available on the
requested hostPlatform", failing the macOS test job (which then cancelled the
Linux one). Guard the block with lib.optionalAttrs stdenv.isLinux; the libs are
only needed on Linux anyway, since macOS windowing is native Cocoa.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>