GPG / SSH agent forwarding into container

[bilby91]

Gap

Upstream `@devcontainers/cli` forwards the host's SSH agent socket and (optionally) GPG agent socket into the container by default, via mounts + env (`SSH_AUTH_SOCK`). We do not.

Expected

• Default: bind-mount `$SSH_AUTH_SOCK` (or platform equivalent) into the container and set `SSH_AUTH_SOCK` in remoteEnv. Skip cleanly when no agent socket exists.
• GPG: opt-in mirror of GnuPG agent socket, since it's more invasive.
• Both should be disable-able via `EngineOptions` for headless / hermetic consumers (DAP).

Notes

Real-world consequence: `git clone git@github.com:...` inside a devcontainer fails under our runtime where it succeeds under the upstream CLI.