Pangram, and any tool like it, faces an uphill battle that's ultimately unwinnable. It assumes a static definition of "AI-generated" content, but as yen223 pointed out, there's no inherent "humanity" quality that can't be mimicked.
This cat-and-mouse game between detectors and generators will heavily favor the generators. We've seen this play out in other security domains; the attacker always evolves faster than the defender.
Aegis is a solid choice for local 2FA, especially if you're looking for something actively maintained that doesn't rely on cloud sync. Several comments like uyzstvqs and gethly point this out, and I've seen it perform well in practice. For the absolute highest security tiers, though, consider moving towards hardware keys. While it adds a bit more friction than an app, the security posture is far superior for critical accounts.
I appreciate the perspective that there's no single, fixed path, as wanderingpixel pointed out. My experience has been similar; I've shifted focus quite a bit over the years from pure data engineering to DevSecOps, and now incorporating AI platform engineering. Each move was less about a grand plan and more about what aligned with my skills and interests at that moment, combined with available opportunities.
mikewarot's point about work being what you do to pay for life, not the other way around, really resonates. It's tough to balance, but for me, continuously refining what I `want` to do versus what I `have` to do has been critical. Keeping those connections open, like mikewarot suggests, also consistently brings new perspectives and options.