fix(yubikey): vertical yk-status, pubkey zsh nomatch, GitHub UI link, drop stale yk-ssh-load files

[DevSecNinja]

Four user-reported papercuts.

1. yk-status: vertical layout

The horizontal heading was hard to scan, especially with three keys plugged in. New layout:

YubiKey 5C NFC FIPS
  Serial:        35984479
  Firmware:      5.7.4
  FIPS:          yes
  Form factor:   Keychain (USB-C), NFC
  FIDO2 PIN:     [OK] set
  SSH key:       [OK] /Users/.../.ssh/id_ed25519_sk_35984479.pub

YubiKey 5C
  Serial:        10572542
  Firmware:      5.2.4
  FIPS:          no
  ...

Heading is just the device type. Detail rows are vertical, one fact per line. Also dropped the literal backticks in the warning messages (yk-enroll → `yk-enroll` showed as \yk-enroll`` in fish).

2. pubkey: fix zsh NOMATCH error

$ pubkey
pubkey:4: no matches found: /Users/.../.ssh/id_ecdsa_sk_*.pub

zsh's NOMATCH option made for x in ~/.ssh/id_ecdsa_sk_*.pub abort the whole function the moment one pattern didn't match. Use find(1) for glob expansion so unmatched patterns just return empty.

3. GitHub Settings URL printed alongside every gh ssh-key add

Not everyone has gh installed/configured. Every nudge in yk-enroll, yk-ssh-new, yk-git-sign-setup and work-checklist now also points at https://github.com/settings/keys for the GUI flow. yk-git-sign-setup also picked up a missing --type authentication line in its mandatory upload prompt.

4. .chezmoiremove for yk-ssh-load

When PR #303 deleted the yk-ssh-load source files, chezmoi did not remove the destination copies on apply (chezmoi only manages files in source state; deletions don't cascade). New home/.chezmoiremove.tmpl lists both yk-ssh-load.sh and yk_ssh_load.fish so a plain chezmoi apply cleans them up.

Verify

./tests/bash/run-tests.sh --test yk-status.bats --test pubkey.bats --test yk-enroll.bats --test work-checklist.bats --test yk-git-sign-setup.bats

51 cases green. New tests:

• yk-status.bats — assertions rewritten for the vertical layout, asserts no horizontal · serial / fw / FIPS markers leak.
• pubkey.bats (new) — 5 cases including a pubkey: works under zsh (no NOMATCH error on unmatched globs) regression.
• yk-enroll.bats + work-checklist.bats — now also assert https://github.com/settings/keys appears.

Files

• home/dot_config/{shell,fish}/functions/yk_status.{sh,fish} — vertical layout
• home/dot_config/shell/aliases.sh (pubkey) — find-based discovery, no shell-glob NOMATCH
• home/dot_config/{shell,fish}/functions/yk-enroll.* — GitHub URL
• home/dot_config/{shell,fish}/functions/yk-ssh-new.* — GitHub URL
• home/dot_config/{shell,fish}/functions/yk-git-sign-setup.* — GitHub URL + missing --type authentication
• home/dot_config/{shell,fish}/functions/work-checklist.* — GitHub URL
• home/.chezmoiremove.tmpl (new) — drops stale yk-ssh-load files on next apply
• tests/bash/yk-status.bats — vertical assertions
• tests/bash/pubkey.bats (new)
• tests/bash/yk-enroll.bats + work-checklist.bats — URL assertions
• docs/yubikey.md — Quick start gained the GitHub UI link