slice 7: PBS recovery-code escrow creation (agent, Phase B) (v0.9.0 wip)

internal/escrow: zero-knowledge escrow creation. R = 10 EFF-wordlist words
(crypto/rand, ~129 bits); wrap K under R via PBS-native key change-passphrase
driven over a stdlib pty (x/sys/unix; output discarded so R can't leak, F-A2);
self-verify the blob recovers K (fingerprint match) before shipping. Opt-in (b)
R-wrapped offline copy + (a) raw paperkey. Live K is byte-unchanged (operates on
a copy). --selftest=escrow-create (-storage/-paperkey/-offline/-upload). Posture
config field (zero_knowledge default). PBSEncKeyPath helper. Grounded by the
escrow spike findings.

Tests: R entropy>=128/format/uniqueness; integration round-trip (wrap->unwrap
fingerprint match, wrong-R fails, K byte-unchanged) guarded to linux+pbc.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/escrow/pty_other.go

@@ -0,0 +1,16 @@
+//go:build !linux
+
+package escrow
+
+import (
+	"context"
+	"fmt"
+	"runtime"
+)
+
+// runWithPassphrase is unsupported off Linux — the agent runs only on Proxmox (Linux) hosts. This
+// stub lets the package compile (and its pure-Go parts, e.g. recovery-code generation, be tested)
+// on other platforms.
+func runWithPassphrase(_ context.Context, _ string, _ int, _ string, _ ...string) error {
+	return fmt.Errorf("escrow: pty-driven key wrap is Linux-only (GOOS=%s)", runtime.GOOS)
+}