Add --wormhole-secret-prompt for pasting a raw wormhole secret

[illuzen]

Some users hold only the raw 32-byte wormhole secret — no mnemonic, seed, or secret file. airdrop check and airdrop claim now accept --wormhole-secret-prompt, which reads the secret pasted at a hidden terminal prompt (rpassword, same as password entry).

The secret intentionally stays off argv, keeping the #160103 policy: command-line values leak into shell history and process listings. A regression test asserts both airdrop commands reject any --wormhole-secret <value> form and that the bare flag parses. The pasted hex goes through parse_secret_hex (stack-buffer decode, no heap copies) and the input string is zeroized after parsing.

README documents the new flag for both commands. ./clippy.sh and the full airdrop suite pass.

Made with Cursor

[n13]

Reviewer model: GPT 5.6 Sol

APPROVE — no blocking findings.

The new flag is wired through both airdrop check and airdrop claim; it reads from the terminal with echo disabled, reuses the fixed-buffer secret parser, wipes the pasted string after parsing, and keeps the parsed bytes in the existing self-zeroizing SpendSecret path. Raw secret values remain rejected on argv, and the README/help text matches the behavior.

Validation:

• SKIP_CIRCUIT_BUILD=1 cargo test --locked cli::airdrop::tests — 25/25 passed in both library and binary targets.
• cargo +nightly-2026-08-31 fmt --all -- --check, git diff --check, and locked Cargo metadata validation passed.
• Live CLI smoke test accepted a dummy 32-byte secret through the hidden prompt without echoing it and proceeded to the expected network request.
• All GitHub CI checks pass, including Linux/macOS build and test, clippy/docs, examples, format, security audit, and dependency cooldown.

No blocking findings.