Harden scripts for non-interactive provisioning

- config/scripts/bw-load-ssh.sh: add ssh-agent retry loop (graphical
  session may not be ready when systemd fires); use process substitution
  instead of pipe to avoid subshell + set -e issues with LOADED counter
- stages/05-git.sh: remove interactive SSH key generation prompt (keys
  come from Bitwarden); pre-accept GitHub host key via ssh-keyscan
  to avoid first-connect prompt during git clone
- stages/04-shell.sh: add sudo chsh fallback (chsh may fail in
  non-interactive provisioning without PAM auth)

stages/05-git.sh

@@ -67,35 +67,21 @@ EOF
   ok "Global .gitignore deployed."
 fi
 
-# ---- Git SSH key ----
-# The Pop machine has a single SSH key: id_ed25519_github
-# Loading is handled by bw-load-ssh.sh (stage 07) from Bitwarden.
-# This stage can generate a new key if one doesn't exist.
-info "Checking SSH keys..."
-if [ ! -f "$HOME/.ssh/id_ed25519" ]; then
-  warn "No SSH key found."
-  warn "Options:"
-  warn "  1. Generate a new key (recommended for new machine):"
-  warn "     ssh-keygen -t ed25519 -C 'hi@julianprester.com'"
-  warn "  2. Restore from backup/Bitwarden (see TODO.md)"
-  warn "  3. Skip for now (run bw-load-ssh.sh later to load from Bitwarden)"
-  echo ""
-  read -r -p "Generate a new SSH key now? [y/N] " response
-  if [[ "$response" =~ ^[Yy]$ ]]; then
-    ssh-keygen -t ed25519 -C "hi@julianprester.com" -f "$HOME/.ssh/id_ed25519" -N "" 2>/dev/null || {
-      warn "Key generation skipped or failed."
-    }
-    ok "SSH key generated: ~/.ssh/id_ed25519.pub"
-    cat "$HOME/.ssh/id_ed25519.pub"
-    warn "Add this key to GitHub: https://github.com/settings/keys"
-  fi
+# ---- SSH keys ----
+# All SSH keys are stored in Bitwarden and loaded via bw-load-ssh.sh (stage 06).
+# No local keys are generated.
+info "SSH keys: loaded from Bitwarden via stage 06 (bw-load-ssh.sh)."
+
+# ---- Pre-accept GitHub host key ----
+# Avoids interactive prompt on first SSH connection to GitHub
+if [ ! -f "$HOME/.ssh/known_hosts" ] || ! ssh-keygen -F github.com &>/dev/null; then
+  info "Adding github.com SSH host key to known_hosts..."
+  mkdir -p "$HOME/.ssh"
+  ssh-keyscan github.com >> "$HOME/.ssh/known_hosts" 2>/dev/null && \
+    chmod 644 "$HOME/.ssh/known_hosts" && \
+    ok "GitHub host key added." || warn "Could not fetch GitHub host key."
 else
-  ok "SSH key already exists."
+  ok "GitHub host key already known."
 fi
 
-# Ensure proper SSH permissions
-chmod 700 "$HOME/.ssh" 2>/dev/null || true
-find "$HOME/.ssh" -type f -name "id_*" -exec chmod 600 {} \; 2>/dev/null || true
-find "$HOME/.ssh" -type f -name "*.pub" -exec chmod 644 {} \; 2>/dev/null || true
-
 ok "Stage 05 complete: Git configured."