Add self-service verify device-flow via the verifier

[TeoSlayer]

Implements the self-service verification UX: pilotctl verify --provider github. The client dials the verifier service over Pilot (PortVerify), runs the OAuth device-flow (prints the user code + URL, polls), receives the KMS-minted badge, and submits it through the daemon (which proves key ownership) to the registry.

Pure pilotctl change — uses the driver's existing Dial + SubmitBadge, no daemon/IPC changes. Speaks pilot-verify's length-prefixed JSON begin/poll protocol (one op per connection). Resolves the verifier by literal address or hostname (default verify). Device-code instructions print to stderr so JSON stdout stays clean.

Also bumps common v0.5.3 → v0.5.5 (both production keys pinned).

Tests

• frame round-trip; wire-key compatibility with pilot-verify's protocol; full begin→poll→ready exchange against a simulated verifier; error-frame surfacing. go test -race green; gofmt + vet clean.