Fix GPG smartcard pinentry routing to Emacs; bump azos-core

The gpg-agent systemd Environment=INSIDE_EMACS=1 hack never worked:
gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on itself at startup by
design, expecting the variable per-connection from the client instead.
Move it to home.sessionVariables so git/gpg invocations themselves carry
it and forward it to gpg-agent via "OPTION putenv=...", which is what
actually routes a pinentry request to Emacs instead of failing on
curses with no tty.

Bump azos-core for the project-brain-aligned todo/workplate/work-history
skills and the global org-roam Read/Edit permission rules.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

features/encryption/default.nix

@@ -37,23 +37,31 @@
         '';
       };
 
-      # pinentry-emacs only attempts its Emacs-loopback socket when ITS OWN
-      # process env has INSIDE_EMACS set (see pinentry-emacs.c) -- and that
-      # process is gpg-agent's child, so it inherits gpg-agent's daemon env,
-      # not the env of whichever client (git, pass, ...) asked it to sign.
-      # Without this, any signing request from outside Emacs (e.g. a plain
-      # terminal, or an agent shelling out to git) always falls through to
-      # the curses pinentry, which fails outright when there's no real tty.
+      # pinentry-emacs needs INSIDE_EMACS set, but NOT on gpg-agent itself:
+      # gpg-agent calls gnupg_unsetenv("INSIDE_EMACS") on its own process at
+      # startup (agent/gpg-agent.c, both supervised and daemon mode) -- by
+      # design, it expects this to arrive per-connection from the CLIENT,
+      # not statically from its own daemon environment. Each gpg/git
+      # invocation reads INSIDE_EMACS from its own env and forwards it to
+      # gpg-agent via "OPTION putenv=INSIDE_EMACS=..." (common/asshelp.c:
+      # send_pinentry_environment); gpg-agent stores that per-session and
+      # copies it into the forked pinentry's actual env for that one
+      # request (agent/call-pinentry.c:atfork_core). So the var has to be
+      # set on whatever shell/process runs git or gpg -- a prior attempt
+      # at this set it on gpg-agent.service's systemd Environment instead,
+      # which gpg-agent silently discards before it can ever be read.
       #
-      # Only safe to force on when Emacs is structurally guaranteed to be
-      # up and responsive -- i.e. under EXWM, where Emacs *is* the window
-      # manager. Elsewhere Emacs may not be running (fine: the loopback
-      # socket connect fails instantly, same fast fallback as today) or may
-      # be running but transiently busy (not fine: pinentry then blocks on
-      # the Assuan handshake for up to its 60s timeout before falling back,
-      # which is strictly worse than today's instant failure).
-      systemd.user.services.gpg-agent.Service.Environment =
-        lib.mkIf config.azos.suites.exwm.enable ["INSIDE_EMACS=1"];
+      # Only safe to set globally when Emacs is structurally guaranteed to
+      # be up and responsive -- i.e. under EXWM, where Emacs *is* the
+      # window manager. Elsewhere Emacs may not be running (fine: the
+      # loopback socket connect fails instantly, same fast fallback as
+      # today) or may be running but transiently busy (not fine: pinentry
+      # then blocks on the Assuan handshake for up to its 60s timeout
+      # before falling back, which is strictly worse than today's instant
+      # failure).
+      home.sessionVariables = lib.mkIf config.azos.suites.exwm.enable {
+        INSIDE_EMACS = "t";
+      };
 
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;