The devbox bind-mounts ~/.ssh read-only. A user ~/.ssh/config with a per-host
ControlPath under it (the CGNAT idiom `ControlPath ~/.ssh/cm/%r@%h:%p`) is
unwritable there, so a plain `ssh <host> pwd` exits 255 trying to bind the
master socket — blocking `pi --ssh <host>` with "Could not resolve remote pwd".
A system default cannot override a user's per-host value (SSH first-value-wins),
so this must be handled in the extension.
- controlPathWritable(): expands ~, tests whether the socket's parent dir is
writable (or missing but creatable via nearest existing ancestor). Pure fs
check — OS-agnostic, no host-OS detection.
- negotiateMaster / negotiateMasterWithPassword: reuse the system master only
when its ControlPath is writable; otherwise start our own /tmp master whose
command-line `-o ControlPath` overrides the user's unwritable path.
- Remote pwd probe: `-o ControlPath=none -o ControlMaster=no` so a read-only
system ControlPath cannot make the initial probe fail.
No behaviour change for configs without ControlMaster. Updates README.md +
AGENTS.md to match.
joakimp
6f7dca06e8