refactor(dotfiles-sync): make SSH key file sync opt-in, drop redundant path-fixing

[baxyz]

Summary

Second of two PRs split from the original combined #74 (see #75, merged and released — helpers4-common:1.1.0 is confirmed live on GHCR, docker manifest inspect ghcr.io/helpers4/devcontainer/helpers4-common:1 now returns 1.1.0). This one is dotfiles-sync only, built on top of that release.

Changes (1.0.8 → 1.1.0)

Two changes, same underlying cause: helpers4-common's new git-config-self-heal.sh (postAttachCommand) now fixes host-specific .gitconfig paths for every consumer automatically, regardless of whether dotfiles-sync is even in use — this feature no longer needs to solve that problem itself.

• SSH private/public key file copying is now opt-in (syncSshKeys, default false). ~/.ssh/config and known_hosts still sync unconditionally — agent forwarding doesn't provide either of those. Normal SSH auth (git clone/push over SSH, ssh to a remote host) already works through the client's own forwarded ssh-agent with no local key file needed at all; copying them by default put private key material on the container's disk for no benefit in the common case, directly against what setups relying purely on agent forwarding deliberately avoid.
• Removed this feature's own .gitconfig path-rewriting and verification (path-keys.sh, REHOMEABLE_PATH_KEYS/VERIFY_ONLY_PATH_KEYS) — helpers4-common's self-heal actively fixes the same class of problem (and more: it also handles credential.helper/gpg.program pointing at a moved binary, which this feature's own version only ever warned about, never fixed), for every consumer, not just this feature's own users.
• Now dependsOn: helpers4-common — shares its h4_detect_cloud_env instead of an inline duplicate of the same Codespaces/Gitpod/DevPod/WSL detection.
• A test fix (Test 8b): tolerate a mismatch between the username option's default and the base image's actual default process user, which showed up as a false failure in CI (unrelated to the actual feature behavior) once this branch first ran against a real matrix entry.

Why this had to wait for #75 to merge and release

devcontainer features test --features dotfiles-sync . resolves dependsOn: ghcr.io/helpers4/devcontainer/helpers4-common:1 from the published GHCR registry, not this repo's local src/ tree — only the feature passed directly via --features gets freshly-built local content. Before #75 merged, this branch's CI failed with h4_detect_cloud_env: command not found because GHCR still only had the old 1.0.1 helpers4-common. Documented in AGENTS.md.

Test plan

• bash -n / jq empty on all changed scripts and manifests
• Real Docker end-to-end: default config skips key files while still merging config/known_hosts; enabling syncSshKeys places the key files, and helpers4-common's self-heal correctly finds the locally-synced .pub by basename to repair a still-host-shaped signingkey path
• Definitive confirmation post-feat(helpers4-common): automatic git-config self-heal on every attach #75-release: rebuilt via the actual devcontainer features test tooling (not a manual simulation) now that helpers4-common:1.1.0 is genuinely on GHCR — the staged dependency content now includes git-config-self-heal.sh and h4_detect_cloud_env, and running test.sh against the actually-built image passes cleanly (environment detected: local, known_hosts still synced regardless of syncSshKeys) — the exact assertion that failed against the pre-release registry state now succeeds

🤖 Generated with Claude Code

[github-actions]

✅ PR Validation Passed

All checks passed!

---

📋 Pipeline Status

	Job	Status
✅	🧾 Conventional Commits	passing
✅	🔖 Version Bump	passing
✅	🧪 Feature Tests	passing
✅	🐚 ShellCheck	passing

---

_{🤖 Generated by @helpers4 CI • 2026-09-06}