Every generated lock still resolved nix-project, which no longer exists, so a clone of any published repo could not evaluate. Each is relocked in a scratch directory holding only that flake.nix, which is what a clone actually has, and now pins tangled.org/overby.me/nix-workspace at the revision just published. Also stops ssh reusing a multiplexed connection. With ControlMaster on, ssh answers from the socket that is already open and never consults -i or IdentitiesOnly, so the knot sees whichever key opened it first and refuses the push with "this ssh key doesn't match any key published by the accounts that may push here" - the one message whose own advice, adding IdentitiesOnly, does not help. ControlPath=none is what makes the offered key the one asked for. Signed-off-by: Niclas Overby <niclas@overby.me>