Initial commit: dial — interactive SSH host picker

A fast, read-only ~/.ssh/config picker that exec's the system ssh client.
Includes: static high-contrast picker with recency/frequency/name sort and
tag grouping, `dial keygen` (native ed25519/RSA + optional config entry), and
an optional offline YubiKey launch gate with one-time recovery codes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.claude/settings.local.json

@@ -0,0 +1,19 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(sudo rm -rf /usr/local/go)",
+      "Bash(sudo tar -C /usr/local -xzf /tmp/go.tgz)",
+      "Bash(/usr/local/go/bin/go version *)",
+      "Bash(tmux send-keys *)",
+      "Bash(tmux capture-pane *)",
+      "Bash(ssh -o BatchMode=yes 192.168.192.201 'sha256sum ~/dial-push-test.txt')",
+      "Bash(tmux kill-session *)",
+      "Bash(rm -f ~/index.html ~/dial-push-test.txt)",
+      "Bash(ssh -o BatchMode=yes 192.168.192.201 'rm -f ~/dial-push-test.txt')",
+      "Bash(ssh -o BatchMode=yes 192.168.192.201 'ls ~')",
+      "Bash(ssh -o BatchMode=yes -o IdentitiesOnly=yes -i ~/.ssh/ssh-test-key -J ben@192.168.192.201 ben@192.168.192.201 'echo JUMP_OK on $\\(hostname\\); id -un')",
+      "Bash(ssh -o BatchMode=yes -o IdentitiesOnly=yes -i ~/.ssh/ssh-test-key 192.168.192.201 'echo on-box; nc -zv 192.168.192.201 22 2>&1 || \\(exec 3<>/dev/tcp/192.168.192.201/22 && echo tcp-self-OK && head -c 40 <&3\\)')",
+      "Bash(ssh -o BatchMode=yes -o IdentitiesOnly=yes -i ~/.ssh/ssh-test-key 192.168.192.201 'grep -i banner /etc/ssh/sshd_config 2>/dev/null; echo \"issue.net:\"; cat /etc/issue.net 2>/dev/null')"
+    ]
+  }
+}