feat(pods): SSH agent forwarding → git push from the pod with your key

Code in your pod and push to git.profullstack.com using the SAME SSH key you
signed in with — nothing is copied into the pod. When a member attaches with
agent forwarding (ssh -A), agentbbs listens on a fresh unix socket in a
per-user agent dir bind-mounted at /run/agentbbs-agent and proxies it back over
the session; the pod shell gets SSH_AUTH_SOCK pointed at it. The pod image's
ssh_config sends git@git.profullstack.com to Forgejo's SSH server (:2222), so
`git clone git@git.profullstack.com:you/repo.git` just works.

- pods.go: agentDir + startAgent (per-session socket, cleaned up on exit);
  Attach injects SSH_AUTH_SOCK when ssh.AgentRequested; ensure() bind-mounts the
  agent dir and self-heals idle pods missing it. No main.go change needed —
  charmbracelet/ssh sets AgentRequested from the session request loop.
- pods/Containerfile: /etc/ssh/ssh_config.d entry (port 2222, user git,
  accept-new) so the conventional git@ URL reaches Forgejo.
- setup.sh: keep using an already-built pod image if a later rebuild
  transient-fails, so a flaky deploy never downgrades pods to the base image.

Build/vet/test/gofmt clean. Image rebuilt on the host; `ssh -G
git.profullstack.com` resolves to port 2222 / user git. End-to-end push needs a
live `ssh -A` session (validate after deploy).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -323,6 +323,12 @@ if [ -f "$SRC_DIR/pods/Containerfile" ]; then
        podman build -t localhost/agentbbs-pod:latest \
        -f "$SRC_DIR/pods/Containerfile" "$SRC_DIR/pods" >/dev/null 2>&1; then
     POD_IMAGE="localhost/agentbbs-pod:latest"
+  elif sudo -u "$SVC_USER" XDG_RUNTIME_DIR="/run/user/$SVC_UID" \
+       podman image exists localhost/agentbbs-pod:latest >/dev/null 2>&1; then
+    # A transient build failure (e.g. registry/network hiccup) must not downgrade
+    # pods back to the base image — keep using the previously built one.
+    POD_IMAGE="localhost/agentbbs-pod:latest"
+    warn "pod image rebuild failed — using the existing localhost/agentbbs-pod:latest"
   else
     warn "pod image build failed — keeping $POD_IMAGE (run: podman build -f $SRC_DIR/pods/Containerfile $SRC_DIR/pods)"
   fi