EUVD-2026-112267

russh: Agent server never calls Agent::confirm, so keys added with the confirm constraint ssh-add -c sign without confirmation...