Use repository Git remotes and SSH config

docs/git-synchronization.md

@@ -50,13 +50,16 @@ are read with size and line bounds; exact, hashed, and bracketed non-default
 port entries are supported. Unknown keys require an explicit call to persist
 the confirmed key atomically. Changed keys always fail and are never replaced.
 
-Authentication uses one configured OpenSSH private-key file (Ed25519, ECDSA,
-or RSA) or one exact SHA-256 fingerprint from an already-running SSH agent.
+Desktop applications take remote names and URLs from the password-store's
+`.git/config`. Authentication uses the matching `~/.ssh/config` identity or an
+explicit OpenSSH private-key file (Ed25519, ECDSA, or RSA), or one exact SHA-256
+fingerprint from an already-running SSH agent.
 Encrypted-key passphrases come from `SecretBytes` in the operating-system
 secret store. Identity attempts are bounded and deterministic; IronStorage
 does not spray keys, use passwords or keyboard-interactive authentication,
-read OpenSSH configuration, start/probe an agent process, or run proxy/helper
-commands. The explicit client allowlist excludes SHA-1 key exchange/MAC,
+start/probe an agent process or run proxy/helper commands. The in-process
+client reads `Host`, `HostName`, `User`, `Port`, and `IdentityFile`; executable
+OpenSSH directives remain disabled. The explicit client allowlist excludes SHA-1 key exchange/MAC,
 RSA/SHA-1 signatures, DSA, CBC, `none`, compression, and host certificates.
 Cancellation interrupts connection and authentication without changing Git,
 known hosts, or secure storage.