feat(keys): session-level SSH_AUTH_SOCK for GUI clients

The agent's SSH socket was only exported via the zsh integration, so a
GUI client launched outside a shell (rofi launcher, autostarted apps)
couldn't use gpg-agent for SSH. Add a home.sessionVariables export
resolving the socket with gpgconf --list-dirs agent-ssh-socket — the
same lookup the shell integration uses, so the two can't drift — which
reaches GUI apps via the login shell that starts Hyprland (the path
NIXOS_OZONE_WL already takes).

Eval-verified: the var resolves to the gpgconf substitution; the home
config still builds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -292,8 +292,15 @@ how to override it. Items marked ✓ are shipped.
   comes from the agent's zsh integration; cache TTLs (30 min / 2 h) govern
   re-prompting. gnome-keyring stays the Secret Service (modern versions run
   no SSH agent, so no socket contention); screen lock doesn't flush the
-  cache. Remaining (optional): a session-level `SSH_AUTH_SOCK` export so GUI
-  clients launched outside a shell also see the agent.
+  cache. ✓ **session-level `SSH_AUTH_SOCK`:** besides the zsh integration,
+  a `home.sessionVariables` export now covers GUI clients launched outside a
+  shell (rofi launcher, autostarted apps) that never inherit the interactive
+  shell's copy — resolved with `gpgconf --list-dirs agent-ssh-socket` at
+  session-init (the same lookup the shell integration uses, so the two can't
+  drift), reaching GUI apps via the login shell that starts Hyprland the same
+  way `NIXOS_OZONE_WL` does. Eval-verified (the var resolves to the gpgconf
+  substitution; home config builds). Pending an on-machine check that a GUI
+  git/ssh client picks up the agent.
 - **Sanitize & organize the repo:** a housekeeping pass for consistency
   and clarity.
   - ✓ pruned now-redundant config: the installer no longer writes

modules/home/keys.nix

@@ -8,10 +8,12 @@
 # GNOME session to lean on) and themed by Stylix's Qt config, so the
 # passphrase dialog tracks the palette.
 #
-# SSH_AUTH_SOCK is exported by the agent's shell integration (zsh, on via
-# home.shell.enableZshIntegration in shell.nix). Terminal git/ssh is the
-# supported path; a GUI client launched outside a shell won't inherit the
-# socket — revisit with a session-level export if that's ever wanted.
+# SSH_AUTH_SOCK reaches both terminal and GUI clients: the agent's zsh
+# integration sets it in interactive shells (home.shell.enableZshIntegration
+# in shell.nix), and a session-level home.sessionVariables export (below)
+# covers GUI clients launched outside a shell — e.g. from the rofi launcher —
+# which never inherit the interactive shell's copy. Both resolve the same
+# socket via gpgconf, so they can't drift.
 #
 # gnome-keyring (system side) stays the Secret Service for application
 # secrets; modern gnome-keyring no longer runs an SSH agent, so there is no
@@ -38,5 +40,16 @@ in
       defaultCacheTtlSsh = 1800;
       maxCacheTtlSsh = 7200;
     };
+
+    # Session-level SSH_AUTH_SOCK so GUI clients launched outside a shell
+    # (rofi launcher, autostarted apps) reach the agent — the shell
+    # integration only covers interactive shells. Resolved with gpgconf at
+    # session-init time (the same lookup the shell integration uses), so it
+    # tracks the agent's real socket rather than a hardcoded path; valid
+    # before first use since the socket is systemd-activated. Reaches GUI
+    # apps the way NIXOS_OZONE_WL does — sourced into the login shell that
+    # starts Hyprland, so every spawned client inherits it.
+    home.sessionVariables.SSH_AUTH_SOCK =
+      "$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)";
   };
 }