docs: document Windows SSH agent selection (#26295)

Document the Windows SSH-agent fallback under `ssh.agentSocketPath`,
including what happens when both the setting and `SSH_AUTH_SOCK` are
unset. Keep the general SSH-agent guide focused on setup and linked to
the settings reference.

Validation: Markdown and style checks pass.

Generated by Codex.

content/manuals/ai/sandboxes/configuration/credentials.md

@@ -385,7 +385,7 @@ $ sbx settings set ssh.agentSocketPath "$SSH_AUTH_SOCK"
 ```
 
 An empty [`ssh.agentSocketPath`](settings.md#sshagentsocketpath), which is the
-default, uses each client's current `SSH_AUTH_SOCK` instead. Use
+default, uses the agent supplied by each client instead. Use
 [`ssh.agentForwardingEnabled`](settings.md#sshagentforwardingenabled) to turn
 forwarding on or off.
 

content/manuals/ai/sandboxes/configuration/settings.md

@@ -214,10 +214,17 @@ $ sbx daemon restart
 ```
 
 Run this from a shell whose `SSH_AUTH_SOCK` points to the intended agent. The
-command stores that path, not a reference to the variable. With an empty value,
-Docker Sandboxes uses the socket supplied by each client instead. Remove the
-fixed path with `sbx settings unset ssh.agentSocketPath` and restart the daemon
-to update existing forwarders.
+command stores that path, not a reference to the variable.
+
+When this setting is empty, Docker Sandboxes uses the `SSH_AUTH_SOCK` value
+supplied by each client. On Windows, if `SSH_AUTH_SOCK` is also unset, it uses
+the `\\.\pipe\openssh-ssh-agent` named pipe. This works with Windows OpenSSH
+and with 1Password's SSH agent when it provides that pipe. The host agent must
+be running. Set `SSH_AUTH_SOCK` or configure `ssh.agentSocketPath` to use a
+different agent.
+
+Remove the fixed path with `sbx settings unset ssh.agentSocketPath` and restart
+the daemon to update existing forwarders.
 
 ### Images and storage