Check keepiq ssh-agent on macOS

[rubenvdlinde]

keepiq ssh-agent (change clients-ssh-agent) has been checked on Linux: eval "$(keepiq ssh-agent)", ssh-add -l, a git clone over SSH, locking with -x, unlocking with -X, and refusing ssh-add <file> all work (PR #1022). The macOS half of task 4.1 needs a Mac.

What is needed

On macOS, follow cli/README.md:

1. Start the agent with eval "$(keepiq ssh-agent)" and check ssh-add -l lists the vault's SSH keys.
2. Clone a repository over SSH with one of those keys.
3. Lock with ssh-add -x and check the clone is refused, then unlock with ssh-add -X.
4. Install the launchd plist from the README and check the agent starts at login.

Report anything that differs from the README.

Who

Anyone on the team with a Mac.

Split from #786 (task 4.1) on 4 October, so that tracker can close.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue

[rubenvdlinde]

Checked on macOS in CI, per Ruben's decision of 4 October (no Mac needed): #1142 adds the 'CLI on macOS' job, and its first run is green (https://github.com/ConductionNL/keepiq/actions/runs/37209235179, macOS 26.6.2, OpenSSH 10.3p1).

• go test in cli/ passed, including the real-sshd test and the eval-hang test. The job fails if any of them is skipped.
• The README flow against a fake Keepiq and a throwaway sshd:
  • eval "$(keepiq ssh-agent)" returned at once.
  • The socket was at $TMPDIR/keepiq-<uid>/agent.sock, 0600 in a 0700 folder.
  • ssh-add -l listed the vault key, and ssh and git clone over SSH worked.
  • -x locked (login refused), a wrong password did not unlock, and -X unlocked.
  • ssh-add <file>, -d and -D were refused, and kill $SSH_AGENT_PID removed the socket.
• The README's launchd plist passed plutil -lint and loaded. The agent started locked, unlocked with -X, served a login, and KeepAlive brought it back locked after a kill.

Not covered: start at a real login after a reboot. Along the way, the README's systemd unit was found not to work; that is fixed separately.