persistent-setup: trust Tails passphrase policy

[BenWestgate]

Refs #240.

Summary

• keep the Tails 7.13 pinentry passphrase prompt open indefinitely
• stop re-scoring a passphrase already accepted by Tails Persistent Storage
• remove the contradictory Bails weak-passphrase/reboot gate

Reproduction

On master at 5147ffd in Tails 7.13:

• leaving the pinentry prompt idle fell through to “Existing Persistent Storage passphrase is required”
• Bails stripped spaces before keepassxc-cli estimate, so random-word passphrases could be scored as a concatenated token and rejected after Tails had already accepted them

The two later master commits change install-core and review automation only; this one-file PR remains mergeable without a rebase.

Testing

• reproduced both reported behaviors in the same Tails 7.13 VM
• patched pinentry remained open past 50 seconds
• a five-word BIP39-style passphrase advanced through setup without the Bails weak-passphrase gate
• bash -n bails/.local/bin/persistent-setup
• shellcheck bails/.local/bin/persistent-setup
• git diff --check origin/master...HEAD
• Lint CI, CodeQL, and dependency review pass

[BenWestgate]

AI-generated review (Claude), posted at the maintainer's request.

ACK the --timeout 0 half of 3c36717. The gate removal needs discussion.

• pinentry-gnome3 --timeout 0 fixes the idle fall-through.
• "Accepted by Tails" means the passphrase unlocks Persistent Storage; it doesn't mean it met a strength bar. Does Tails enforce a minimum? If not, this drops the only check. A smaller fix for the reported bug is to stop stripping spaces ("$existing_passphrase" instead of "${existing_passphrase// /}") and make the <50-bit case a warning rather than a forced reboot.
• Merges cleanly with #202, #217 and #234.

[BenWestgate]

• "Accepted by Tails" means the passphrase unlocks Persistent Storage; it doesn't mean it met a strength bar. Does Tails enforce a minimum? If not, this drops the only check. A smaller fix for the reported bug is to stop stripping spaces ("$existing_passphrase" instead of "${existing_passphrase// /}") and make the <50-bit case a warning rather than a forced reboot.

• Merges cleanly with wallet: Remove legacy bails-wallet #202, passphrase: Persist repetition schedule #217 and wallet: Disable legacy GTK3 flow #234.

Tails does not force a minimum. They recommend 5 to 7 random words and the Persistent Storage app shows 6.

[BenWestgate]

A smaller fix for the reported bug is to stop stripping spaces ("$existing_passphrase" instead of "${existing_passphrase// /}") and make the <50-bit case a warning rather than a forced reboot.

I would ACK this.

[BenWestgate]

Superseded by #289. That stacked PR keeps this fix (trust Tails' passphrase policy and indefinite pinentry) while moving all optional passphrase-training ownership out of persistent-setup, so keeping both PRs open would duplicate edits in the same boundary.