* fix(desktop): harvest login-shell SSH_AUTH_SOCK for git sync

Finder-launched Electron inherits launchd's SSH_AUTH_SOCK, which points at
Apple's default ssh-agent. Users whose keys live in an external SSH agent
(1Password, Proton Pass) export the real socket path in their shell rc, so
terminal git works while in-app sync fails with Permission denied
(publickey). The forwarding in buildGitEnv was already correct; the value
it forwarded was wrong from birth.

Spawn one interactive login shell at startup (same pattern and spawn
discipline as path-install's PATH discovery, sentinel-delimited so rc
noise cannot corrupt the value), read SSH_AUTH_SOCK, and patch process.env
before the git preflight and both server spawn paths. A failed, timed-out,
or empty harvest leaves the inherited socket untouched.

Verified against a live repro: stock ssh-agent on a custom socket exported
only via .zshrc, key registered with GitHub, packaged Finder-launched
build. Sync fails before the change, succeeds after, and fails again when
the rc export is removed.

Fixes #669

* chore(scripts): brace OK_DIR expansion in setup-open-knowledge echo

Under macOS bash 3.2 with a non-UTF-8 locale, the bare $OK_DIR followed
immediately by a multibyte ellipsis parses the ellipsis into the variable
name, and set -u aborts the script with 'OK_DIR: unbound variable' before
the install runs. Bracing the expansion makes the script locale-proof.

* fix(desktop): carry stderr and from/to values in authsock log events

Review follow-up on the SSH_AUTH_SOCK harvest: the non-zero-exit failure
event now includes the shell's stderr (truncated to 300 chars, since a
broken rc file can produce unbounded output), and the success event
records the previous and new socket values so a correct upgrade is
distinguishable from a stale-path regression in field logs.

* fix(desktop): make gitSpawnEnv read live env so the harvest reaches all git spawns

Review follow-up: worktree-service and worktree-recents froze
gitSpawnEnv() into module-level constants at import time, and gitSpawnEnv
itself cached the whole env object on first call. Either way the
share-fetch and worktree git spawns kept the pre-harvest launchd
SSH_AUTH_SOCK, so the external-agent fix never reached that transport.

gitSpawnEnv now caches only the augmented PATH (the expensive stat walk)
and rebuilds the env from live process.env per call. The two module-level
constants become per-call lookups, FETCH_GIT_ENV becomes fetchGitEnv(),
and a new git-spawn-env test pins the live-read contract so a future
snapshot regression fails fast. The index.ts wiring comment now states
the actual guarantee instead of overclaiming lazy-cache coverage.

Also carries the marker-missing harvest failure's bounded stdout, the one
diagnostic explaining why markers were absent.

GitOrigin-RevId: feab7f47b1b96fb359c69386d8841f25e1eba9b5