hee-cred -- real, minimal GPG-backed credential store
=======================================================

STORE a secret (interactive only -- refuses if stdin isn't a real
terminal, on purpose, so a secret can never be piped in from a
chat/log/script):

  hee cred -seal <account> -recipients <gpg-id1>,<gpg-id2>

Types a hidden prompt, confirm, done.

READ a secret back -- exec-only, never printed. $HEE_CRED_PASS is set
in the child process's environment ONLY, never argv, never stdout:

  hee cred -pass <account> -exec <command...>

Example, real, verified working tonight:

  hee cred -pass <account> -exec bash -c \
    'curl -s -H "Authorization: Bearer $HEE_CRED_PASS" \
    "https://api.example.com/whatever"'

GENERATE instead of typing (real corpus-derived passphrase, still
never printed, flows straight into the same GPG encrypt call):

  hee cred -seal <account> -recipients <ids> -genfrom <term> [-blocks N]

Real GPG key IDs on kiosk, as of tonight:
  touchy-claude:              6A58FE47EF8900C40F911FA6A2268DFF20623188
  spencer (kiosk-local):      73B1462A91E844FD96607C157CE485B26654FDA0
  spencer (real, from nuc-1): 2D990922FB9DCAB3EE405C710C2E2A08D47F2A2B