Carry #564's ssh-agent symlink edits through the #504 rebase (1 conflict hunk + 8 test seeds) #567

Why this exists

#564 (approved) and #504 both modify acq_backend_terminate, and #504 moves ssh-auth-sock from a guest marker to a host-config key. Whichever lands second needs a real conflict resolution plus test-fixture changes — not a fast-forward.

@basiliskus already measured the exact delta by trial-merging #564 onto docs/adr-host-authoritative-config (256d069). Filing it so those findings are not rediscovered by whoever lands the second PR, and so the work is tracked rather than living only in a PR comment thread.

The measured delta

Merging #564 onto #504:

1. One conflict hunk, in acq_backend_terminate.
   Resolution: keep both cleanup calls — _acq_msb_ssh_agent_link_remove "$1" (fix(msb): route ssh-agent forward through a managed symlink #564) and docs(adr): add ADR-0035 host-authoritative sandbox configuration #504's host-config cleanup.

2. Three tests fail until each bridge-restart block seeds the host-config record: 10c24, 10c25, 10c30 in test/bats/115-ssh-agent-forward.bats.
   Resolution: 8 one-line additions of seed_host_config msb <name> || true.

With both applied, 115-ssh-agent-forward.bats passes 34/34 on the merged tree.

Preferred order

@basiliskus stated a preference for #504 landing first, then rebasing #564 onto it and carrying the edits above. Recording that here so the ordering is a decision rather than an accident of merge timing.

If #564 lands first instead, the same two resolutions apply in reverse — #504's author inherits them.

Acceptance

• Whichever PR lands second is rebased onto the first
• acq_backend_terminate retains both cleanup calls
• 115-ssh-agent-forward.bats is 34/34 on the merged tree
• seed_host_config is called in each bridge-restart block that needs it

Related

• fix(msb): route ssh-agent forward through a managed symlink #564 — ssh-agent route via managed symlink (approved, awaiting merge)
• docs(adr): add ADR-0035 host-authoritative sandbox configuration #504 — ADR-0035 host-authoritative sandbox config
• feat(acq): acq restore re-derives the msb --vsock route (SSH signing survives reboot) #501 — the reboot case fix(msb): route ssh-agent forward through a managed symlink #564 fixes

Separately, note seed_host_config in scripts/test-acq-lib.sh returns non-zero when STUB_RECORDED_KIT_ENV is unset (bare [ -n ... ] && ... as its last line), which is why the additions above need || true. @basiliskus raised that on #504; ending the function with return 0 would make the || true unnecessary.