feat(yubikey): yk-status health checks; pubkey per-serial; remove yk-ssh-load

[DevSecNinja]

Three follow-ups from continued macOS dogfooding plus a hard-removal.

1. yk-status: device-type heading + health checks

Output now leads with the device type (the most recognisable thing) and shows a per-device health checklist:

YubiKey 5C NFC FIPS  ·  serial 35984479  ·  fw 5.7.4  ·  FIPS
  Form factor:   Keychain (USB-C), NFC
  FIDO2 PIN:     [OK] set
  SSH key:       [OK] /Users/.../.ssh/id_ed25519_sk_35984479.pub

YubiKey 5C  ·  serial 30205443  ·  fw 5.4.3
  Form factor:   Keychain (USB-C)
  FIDO2 PIN:     [WARN] not set    (run `yk-enroll`)
  SSH key:       [WARN] not enrolled  (run `yk-enroll`)
  Note:          firmware <5.7 — some features (e.g. PIV ed25519) unavailable

PIN check uses the same robust regex as yk-enroll (handles legacy PIN is set and modern PIN: N attempt(s) remaining). SSH key check stats ~/.ssh/id_<type>_sk_<serial> + .pub. --json output gains pin_set and ssh_key fields. The fish version was missing device_type entirely — fully rewritten.

2. pubkey: discover per-serial key files

$ pubkey
No SSH public key found in ~/.ssh   ← even on a freshly-enrolled YubiKey

Was matching only the legacy un-suffixed id_<type>_sk.pub. yk-enroll writes id_<type>_sk_<serial>.pub. Now globs the per-serial pattern first, then legacy, then non-FIDO2. Bash + fish.

3. yk-ssh-load: hard-removed

Made obsolete by per-serial files being discovered via the SSH config glob (#298) — every key is IdentityFile-listed automatically. The old workflow (ssh-add -K to pull resident creds into the agent) is also actively incompatible with the new IdentitiesOnly yes posture from #302 (no agent caching for FIDO2 keys, since ssh-agent can't re-prompt for the FIDO2 PIN).

No deprecation period — per request:

• home/dot_config/shell/functions/yk-ssh-load.sh — deleted
• home/dot_config/fish/functions/yk_ssh_load.fish — deleted
• tests/bash/yk-ssh-load.bats — deleted
• References removed from home/private_dot_ssh/config.tmpl (comment) and docs/yubikey.md (Quick start, helpers table)

Verify

./tests/bash/run-tests.sh --test yk-status.bats --test yk-enroll.bats --test yk-ssh-new.bats

12 yk-status cases (fully rewritten), 18 yk-enroll, all yk-ssh-new — green. Full-suite failures are pre-existing and unrelated (sandbox has chezmoi 2.70.1 vs source state requiring 2.70.2).

Files

• home/dot_config/shell/functions/yk-status.sh — health checks, device-type heading
• home/dot_config/fish/functions/yk_status.fish — full rewrite (was missing device_type and health checks)
• home/dot_config/shell/aliases.sh (pubkey) — globs per-serial files
• home/dot_config/fish/conf.d/aliases.fish (pubkey) — same
• home/dot_config/{shell,fish}/functions/yk{-,_}ssh{-,_}load.{sh,fish} — deleted
• tests/bash/yk-ssh-load.bats — deleted
• tests/bash/yk-status.bats — fully rewritten (12 cases)
• home/private_dot_ssh/config.tmpl — yk-ssh-load references removed
• docs/yubikey.md — Quick start + helpers table updated, pubkey doc note refreshed