- Cache PIN in kernel keyring (keyctl) for 5 minutes with sliding window
- Show menu to use cached PIN or clear cache when cache exists
- Escape <, >, & in SSH args for pango markup (fixes empty prompt with
commands containing redirections like 2>/dev/null)

Add a rofi-based pinentry for TPM SSH authentication that displays
the SSH command being authenticated (destination, flags, arguments).

- Patch ssh-tpm-agent to pass client PID via SSH_CLIENT_PID env var
using SO_PEERCRED on the Unix socket
- New pinentry-rofi tool reads /proc/<pid>/cmdline to show SSH args
- Update tpm2.nix to use the patched agent and new pinentry

Run packages from superconfig with a short command.
Uses ~/src/superconfig if available, falls back to built-in flake reference.