feat: gate confirm-mode tsm run on biometric presentability, not caller TTY

[tashian]

What & why

tsm run previously refused any confirm-gated secret whenever stdin was not a TTY, using caller-TTY as a proxy for "a human is present to approve." That proxy misfires for agent harnesses like Claude Code's Bash tool: their background shells have no TTY but run in a live GUI login session where Touch ID works fine. The Touch ID prompt is a system dialog presented by the daemon (which lives in the user's GUI session) — it appears on the user's screen regardless of how the caller's stdin is wired. So the old check blocked a perfectly workable path (verified: canEvaluatePolicy returns true, and a real prompt appears, from a non-TTY context).

This replaces the TTY heuristic with a capability check against the daemon.

Changes

Daemon (0bc528d)

• AuthProvider.canAuthenticate() — canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics), presents no UI.
• New auth.can_confirm JSON-RPC method via Vault.canConfirm() → {"can_confirm": bool}.

CLI + skill (ee6b5d7)

• tsm run drops the term.IsTerminal(stdin) gate. When requested secrets are confirm-gated, it asks auth.can_confirm: proceed (daemon prompts) when biometrics can be presented; refuse cleanly only in truly headless contexts (no GUI session — CI, cron, ssh without a console).
• credential-usage/SKILL.md §3 rewritten: confirm-gated secrets now work from non-TTY callers; the agent should warn the user a Touch ID prompt is coming rather than hand off to a separate terminal.

Behavior change to note

A confirm-gated secret in an attended GUI session will now also prompt for genuinely unattended automation (it blocks on the dialog until the system timeout, instead of failing fast as the old TTY check did). That's the intended semantics of confirm mode — require a human touch per access — but it is a change from the prior fail-fast.

Testing

• Swift: 124 tests pass, incl. new testAuthCanConfirmReportsBiometricAvailability.
• Go: all cmd tests pass; tsm run confirm tests rewritten to drive auth.can_confirm (biometrics available → proceeds; unavailable → refuses).
• Live, from a non-TTY shell against installed binaries:
  • auth.can_confirm over the wire → {"can_confirm":true}.
  • non-confirm tsm run → injected via cached unlock, no prompt.
  • confirm tsm run → Touch ID prompt appeared and was approved, secret injected. (Old code: hard stdin is not a TTY refusal.)