Keychain 3.0.9

Keychain 3.0.9 makes everyday shell startup faster and more dependable across operating systems, with more reliable agent discovery and tighter checks on saved state and command arguments.

• Reduced startup overhead, particularly for commands that do not load keys. On Linux, Keychain now reads process information directly from /proc, avoiding the cost of launching ps and working without it on minimal systems such as BusyBox-based installations.
• Some Linux and Android configurations hide running SSH agents from process listings, causing Keychain to reject an otherwise usable agent. Keychain can now reuse a responding, user-owned socket when the recorded PID is alive but its details are inaccessible. keychain inspect explains this restriction; stopping an agent still requires verifying its process identity (#270).
• Differences in ps output could make existing agents go undetected. Corrected discovery on Cygwin and MSYS2 (PR #276), and addressed truncated process names on macOS, BSD and Solaris/illumos. Linux discovery also skips zombie processes and tolerates processes disappearing during a scan.
• A failed or unusable process listing could previously look like no agents were running. Keychain now reports a clear error instead of starting replacement agents or discarding saved references on that basis.
• The legacy --stop mine and --stop all selections were reversed. Restored their Keychain 2.x behavior: mine stops the agent recorded in Keychain's pidfile, while all stops all visible SSH agents owned by the calling user. Updated help text and diagnostics to make agent selection clearer.
• An SSH configuration containing only Host * could leave --confallhosts with no identities to load. Keychain now asks OpenSSH for those catch-all settings when there are no concrete host names, and resolves home-directory paths in the returned identities.
• A missing username entry could cause ownership and permission checks to be skipped. Keychain now checks numeric user IDs directly, so a missing account name neither bypasses checks nor rejects a directory that belongs to you.
• Invalid hostname overrides are now rejected before they can affect Keychain's file paths. Names beginning with - are passed to SSH and GPG tools as operands, preventing them from being interpreted as command options.

Expanded regression coverage includes real-agent reuse on MSYS2, restricted Linux process visibility, minimal Linux environments, and native FreeBSD, OpenBSD and OmniOS tests. Platform-specific behavior is now isolated to make future fixes less likely to affect other systems. Thanks to Fumiyuki Shimizu (@fmrns) for the Cygwin/MSYS2 fix, and @tarilka0gg for startup improvements, security fixes, review and follow-up fixes.