Warning: This build has drifted.
The coverage report for this pull request build may be inaccurate because its base commit is no longer the HEAD of its target branch.
This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

    • Learn more: For more information on this, see Tracking coverage changes for pull request builds.
    • Fix now: For a quick fix, rebase this PR at GitHub. Your next report should be accurate.
    • Prevent going forward: To avoid this issue with future PRs, see these Recommended CI Configurations.

fix: bound the agent key listing by the connector timeout

resolvePreferredKey called List() with no deadline, so with --ssh-agent and
-k an agent that accepts the connection but never replies blocked WithAgent.
makeRunner calls it before the mode branches, so --local, --gen and
local-only tasks hung at startup, and Ctrl-C didn't stop it. The agent
connection now gets the connector timeout as its deadline, zero meaning no
deadline as in sshClient; the WARN and public key fallback are unchanged.

publicKeyFor and preferKey are now Connector methods. README mentions that
PEM-encrypted keys need the .pub too, same as sk keys.

Related to #370