"pass generate" has a -i flag to only replace the password in a file (assumed to be the first line)