🥇 export from upstream (0ae8b80)

README.md

@@ -78,8 +78,9 @@ sandcage codex -p ~/project          # run Codex instead
 sandcage shell                        # interactive shell, same environment
 sandcage claude --shell              # shell in the Claude image (debugging)
 sandcage init                         # detect ecosystem, generate .sandcage.yml
-sandcage setup ssh                    # configure SSH key mounting
-sandcage setup ssh --global          # configure SSH globally
+sandcage setup ssh                    # select and copy SSH keys for containers
+sandcage setup ssh --global          # store SSH config globally
+sandcage setup ssh --refresh         # re-sync keys after changes
 ```
 
 ## Configuration
@@ -107,14 +108,14 @@ toolchains:
   node: "20"
 env:
   DATABASE_URL: "postgres://localhost:5432/dev"
-mounts:
-  - ~/.ssh:/home/agent/.ssh:ro
 agent_args:
   claude:
     - --dangerously-skip-permissions
 shell: zsh
 ```
 
+SSH key access is configured separately via `sandcage setup ssh`, which selects only the keys needed for git and copies them into a dedicated Docker volume.
+
 Run `sandcage init` to generate a starter config — it detects your project ecosystem (Rust, Node, Python, Go) and suggests appropriate toolchains and packages.
 
 ## Docker Image