Cover passphrase injection via script(1) with env vars and the SSH_ASKPASS alternative for headless automation.