feat(pods): SSH agent forwarding → git push from the pod with your key

Code in your pod and push to git.profullstack.com using the SAME SSH key you
signed in with — nothing is copied into the pod. When a member attaches with
agent forwarding (ssh -A), agentbbs listens on a fresh unix socket in a
per-user agent dir bind-mounted at /run/agentbbs-agent and proxies it back over
the session; the pod shell gets SSH_AUTH_SOCK pointed at it. The pod image's
ssh_config sends git@git.profullstack.com to Forgejo's SSH server (:2222), so
`git clone git@git.profullstack.com:you/repo.git` just works.

- pods.go: agentDir + startAgent (per-session socket, cleaned up on exit);
  Attach injects SSH_AUTH_SOCK when ssh.AgentRequested; ensure() bind-mounts the
  agent dir and self-heals idle pods missing it. No main.go change needed —
  charmbracelet/ssh sets AgentRequested from the session request loop.
- pods/Containerfile: /etc/ssh/ssh_config.d entry (port 2222, user git,
  accept-new) so the conventional git@ URL reaches Forgejo.
- setup.sh: keep using an already-built pod image if a later rebuild
  transient-fails, so a flaky deploy never downgrades pods to the base image.

Build/vet/test/gofmt clean. Image rebuilt on the host; `ssh -G
git.profullstack.com` resolves to port 2222 / user git. End-to-end push needs a
live `ssh -A` session (validate after deploy).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pods/Containerfile

@@ -42,4 +42,16 @@ RUN printf '%s\n' \
  && printf '[ -n "$PS1" ] && [ -r /etc/motd ] && cat /etc/motd\n' \
   > /etc/profile.d/10-agentbbs-motd.sh
 
+# Make `git@git.profullstack.com:...` reach Forgejo's SSH server (port 2222) and
+# trust it on first use, so clones/pushes just work with a forwarded agent key.
+RUN install -d -m 0755 /etc/ssh/ssh_config.d \
+ && printf '%s\n' \
+  'Host git.profullstack.com' \
+  '    Port 2222' \
+  '    User git' \
+  '    StrictHostKeyChecking accept-new' \
+  > /etc/ssh/ssh_config.d/10-agentgit.conf \
+ && grep -q 'ssh_config.d/\*.conf' /etc/ssh/ssh_config 2>/dev/null \
+  || printf '\nInclude /etc/ssh/ssh_config.d/*.conf\n' >> /etc/ssh/ssh_config
+
 CMD ["sleep", "infinity"]