ns-ui / bitting-cut

Each passkey's bitting is cut from its credential id — same id, same six notches, every time. Add enrolls a new key with a one-shot cutter pass; Remove arms, then confirms, then files the profile flat before the row leaves.