create_trees: whitelist SSH_AGENT_PID/AUTH_SOCK