feat(ssh-controlmaster): use ~/.ssh-local/config so pi --ssh can reach LAN peers

dssh reaches host-LAN peers from inside the devbox container because it runs
`ssh -F ~/.ssh-local/config` (which Includes the host-owned, bind-mounted
ssh-lan.conf carrying `ProxyJump host` entries). pi --ssh shelled out to plain
`ssh`/`ssh -G` against the default ~/.ssh/config, which has no jump, so it
could not reach peers the host can.

Thread `-F <config>` through every ssh call (ssh -G, pwd probe, master start
for both key and password paths, sshExec, bash exec, ssh -O exit), resolved
once at load by resolveSshConfigOpts():
  PI_SSH_CONFIG (leading ~ expanded, honored even if missing)
  else ~/.ssh-local/config if present
  else [] (no -F)

No hostnames are baked into the image — the LAN list lives only in the
host-owned, read-only-mounted ~/.config/devbox-shell/ssh-lan.conf. On the host
(native pi) ~/.ssh-local/config doesn't exist, so -F is omitted and behavior is
unchanged. Command-line -o options still win over -F, so own-master /tmp socket
and ControlMaster decisions are unaffected. Status/notify shows [config: <path>]
when a non-default config is used.

Verified from the container: the patched probe reaches an enrolled peer (pve ->
/root) where plain ssh times out. Reaching a new peer (e.g. alpserv-2) is now a
one-line host-side edit to ssh-lan.conf.

Docs: README + AGENTS.md updated.

AGENTS.md

@@ -134,6 +134,24 @@ on a remote machine via SSH when `--ssh user@host` is passed.
   route without a `ProxyJump host` entry, so `pi --ssh <lan-host>` from the
   container now fails fast instead of stalling on the OS TCP timeout.
 
+- **LAN reachability via `-F` config detection (`SSH_CONFIG_OPTS`).**  
+  Every ssh call (`ssh -G`, pwd probe, master start, `sshExec`, bash exec,
+  `ssh -O exit`) is prefixed with `...SSH_CONFIG_OPTS`, resolved once at module
+  load by `resolveSshConfigOpts()`: `PI_SSH_CONFIG` if set (leading `~`
+  expanded, honored even if missing), else `~/.ssh-local/config` if it exists,
+  else `[]`. This closes the gap where `dssh` (`ssh -F ~/.ssh-local/config`)
+  could reach LAN peers via `ProxyJump host` but `pi --ssh` — which shelled out
+  to plain `ssh`/`ssh -G` against the default `~/.ssh/config` — could not. The
+  sidecar config is regenerated by the devbox's `setup-lan-access.sh` on every
+  container start and includes the host-owned, read-only-mounted
+  `~/.config/devbox-shell/ssh-lan.conf` (the `ProxyJump host` list). **No
+  hostnames are baked into the image**; on the host `~/.ssh-local/config` is
+  absent so `-F` is omitted and behavior is unchanged. Command-line `-o`
+  options still win over the `-F` config, so the own-master `/tmp` socket path
+  and `ControlMaster=yes/no` decisions are unaffected. Enrolling a new peer is a
+  one-line host-side edit to `ssh-lan.conf` (the peer must already be a `Host`
+  block in the host's `~/.ssh/config`, which supplies HostName/User/key).
+
 - **Password auth via `--ssh-ask-pass`.**  
   When the flag is set, `ctx.ui.input()` prompts for a password before
   connecting. The password is passed to SSH via `SSH_ASKPASS`: a temp script at