feat(ssh): support YubiKey PIV through SSH agent

[WilliamWang1721]

Summary

Pebrel's built-in russh path did not use the current SSH agent, so a YubiKey PIV key loaded through PKCS#11 could not authenticate an in-app SSH session.

This intentionally keeps the change small:

• add SSH-agent identities to the existing Auto authentication plan on Unix; signing stays in russh/the SSH agent;
• add pebrel yubikey [--provider PATH] on macOS/Linux, loading Yubico's libykcs11 with ssh-add -s;
• reuse the existing authentication timeout and fallback chain;
• regenerate the existing shell completion snapshots;
• record the authentication ownership decision required by the repository's architecture-note policy.

No new dependency, authentication mode, settings/UI state, PIN storage, key generation/import, persistent helper agent, defensive probe framework, or defensive test suite is introduced.

Validation

Branch: codex/yubikey-piv
Final SHA: 6fc3404eb277422abeb1c92a907338bac724d1dc
Base: a95b6c6f86bc6b9781791ee2331b5373fa59560a

Exact-SHA validation run: 35445848364

• Architecture contracts ✅
• Ubuntu 24.04 native tests + release check ✅
• Windows Server 2022 x64 native tests + release check ✅
• Windows 11 ARM64 native tests + release check ✅
• macOS 26 ARM native tests ✅
• macOS 26 Intel native tests ✅
• macOS 26 ARM release workspace ✅
• macOS 26 Intel release workspace ✅
• shell completion snapshots regenerated and verified ✅

GitHub-hosted CI has no physical YubiKey attached, so PIN/touch hardware acceptance is not claimed as an automated test.

The branch is rebased on the current upstream main and is not behind it.