fix(client): keychain -> ssh-agent

keychain is cool but is first of all unmaintained, and only really works
in the context of a shell. since it "dynamically" starts agents and
exports variables (with set -U to make matters worse), nothing exists
outside of the context of the shell which makes it impossible to sign
commits in gui apps (except vscode for some reason); using a classical
ssh-agent with the env var exported by hand simply works

programs/ssh-agent.nix

@@ -0,0 +1,13 @@
+{ lib, pkgs, ... }:
+{
+  environment.sessionVariables = {
+    SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/ssh-agent";
+    SSH_ASKPASS_REQUIRE = "prefer";
+  };
+
+  systemd.user.services.ssh-agent = {
+    wantedBy = [ "default.target" ];
+    environment.SSH_AUTH_SOCK = "%t/ssh-agent";
+    script = "${lib.getExe' pkgs.openssh "ssh-agent"} -d -a $SSH_AUTH_SOCK";
+  };
+}