Cannot run keybase pgp decrypt non-interactively in oneshot mode

`keybase pgp decrypt` prompts for the Keybase passphrase in oneshot mode. That precludes it from working in an automated workflow:
```
$ docker run --rm \
-e KEYBASE_USERNAME="${KEYBASE_USERNAME}" \
-e KEYBASE_PAPERKEY="${KEYBASE_PAPERKEY}" \
-e KEYBASE_SERVICE="1" \
keybaseio/client

$ docker exec -it --user keybase sh
> echo "" | keybase pgp decrypt
Please enter your Keybase passphrase to unlock the secret key for:
PGP key ABCDEFG123456789

Reason: PGP Decryption:
▶ ERROR decrypt error: unable to find a PGP decryption key for this message
```

If I log in with `keybase login`, running `keybase pgp decrypt` will decrypt the input without prompting for a passphrase:
```
# From my local machine (Mac client)

$ echo "" | keybase pgp decrypt
▶ ERROR decrypt error: unable to find a PGP decryption key for this message

$ gpg --list-secret-keys
# No keys in my keyring that are causing this to work

$ keybase login

$ echo "" | keybase pgp decrypt

```

I read through [Troubleshooting the keybase command line](https://github.com/keybase/client/blob/master/go/doc/troubleshooting.md#troubleshooting-the-keybase-command-line), and tried setting `pinentry.disabled true`. That ultimately fails for the same reason, but without prompting for the passphrase. I don't think that flag is intended to solve my problem:

```
$ docker run --rm \
-e KEYBASE_USERNAME="${KEYBASE_USERNAME}" \
-e KEYBASE_PAPERKEY="${KEYBASE_PAPERKEY}" \
-e KEYBASE_SERVICE="1" \
keybaseio/client

$ docker exec -it --user keybase sh
> keybase config set -b pinentry.disabled true
> echo "" | keybase pgp decrypt
▶ ERROR decrypt error: unable to find a PGP decryption key for this message
```

**My use case**: I need to run the keybase client in a containerized workflow (currently using keybaseio/client:6.0.2-alpine) that decrypts an encrypted value, then stores it in a separate secrets backend.

Is there any way to accomplish this in oneshot mode?

Start with the `keybase pgp decrypt` CLI entry point and reproduce the oneshot workflow in the `keybaseio/client` container, including the attempted `pinentry.disabled` setting. Trace how oneshot mode obtains the passphrase and decryption key; done means the documented container command decrypts input non-interactively without requiring an existing interactive login.

Written by the indexing model from the issue text.