Initial commit: dial — interactive SSH host picker

A fast, read-only ~/.ssh/config picker that exec's the system ssh client.
Includes: static high-contrast picker with recency/frequency/name sort and
tag grouping, `dial keygen` (native ed25519/RSA + optional config entry), and
an optional offline YubiKey launch gate with one-time recovery codes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/connect/connect.go

@@ -0,0 +1,24 @@
+// Package connect turns a selected host alias into a handover to the system's
+// real ssh client. It is deliberately decoupled from the picker: the picker's
+// job ends at "here is an alias", and connect's job is "hand the terminal to
+// ssh <alias>". This keeps the select-a-host logic decoupled from the handover.
+package connect
+
+// Command describes an external client invocation that dial hands the terminal
+// over to. dial never wraps or proxies the session; it exec's the real binary.
+type Command struct {
+	Bin  string   // program to run, resolved via PATH (e.g. "ssh", "sftp")
+	Args []string // arguments after the program name (argv0 is added by Exec)
+}
+
+// SSH opens an interactive shell session on alias, letting the system ssh
+// client re-resolve everything (ProxyJump, agent forwarding, tty, etc.).
+func SSH(alias string) Command {
+	return Command{Bin: "ssh", Args: []string{alias}}
+}
+
+// Exec hands terminal control to the command. On Unix this replaces the current
+// process image, so it only returns if the exec itself fails (e.g. the binary
+// is missing). On Windows it runs the child with inherited stdio and exits with
+// the child's status, so it likewise does not return on success.
+func (c Command) Exec() error { return execCommand(c) }