Using ssh with AddKeysToAgent enabled makes one ssh-agent connection
and keeps it open, then when the key passphrase is entered, it tries
connecting again to add it. Since we were blocking on one client
connection at a time, ssh would just hang in netio trying to
connect().

Each child process needs its own X11 connection so the unveil calls
in the main process have to go, but now each child process can
pledge to just "stdio ps".