Function cmd_provision_token 

pub(crate) fn cmd_provision_token(secrets_file_path: &str) -> Result<()>

Provision a fresh chip in one orchestrated pass.

Sequence:

1. Info to capture the chip serial.
2. ProvisionIoKey -> chip generates random 32 bytes, writes slot 8, returns the key.
3. ProvisionInitialPin -> chip writes SHA-256(“0000” || salt) to slot 5.
4. ProvisionInitialPuk -> chip generates 8-digit PUK, writes hash to slot 6, returns the PUK.
5. GenKey --slot 0 -> chip generates primary ECC key on chip.
6. Write the IO key + PUK + serial to secrets_file (JSON) and print on stdout.

Refuses to overwrite an existing secrets_file: the caller must move or delete an existing one to re-provision.