Turn IdentitiesOnly off for ssh to (closes #74)

ssh to now gives ssh -o IdentitiesOnly=no before the host, next to
-o IdentityAgent. With IdentitiesOnly yes in the user's ssh
configuration, ssh listed the agent's key but never offered it, and
the login failed with Permission denied. An option on the command
line wins over the configuration, and the tool's agent holds only the
derived key, so turning the option off adds no other key. A test
against the stand-in ssh requires the option before the host, and the
README's ssh to section names both options.

Model: opus-5-5

internal/cli/ssh/to.go

@@ -57,8 +57,13 @@ func to() *cobra.Command {
 
 			defer served.Stop()
 
+			// IdentitiesOnly yes in the user's ssh configuration
+			// would keep the agent's key from being offered. The
+			// agent holds only the derived key, so turning it off
+			// adds no other key.
 			argv := slices.Concat([]string{
 				"-o", "IdentityAgent=" + served.Socket(),
+				"-o", "IdentitiesOnly=no",
 			}, args)
 
 			return connect(ctx, argv)