Run commands with phone-approved secrets, including SSH authentication and Git signing. Use for Agentknock installation, pairing, and credential migration too.
