if i'm using gpg-agent's ssh-agent capabilities, and i request that a
key be added with a confirmation prompt (ssh-add -c), gpg-agent claims
i will get one, but i do not.  Also, if i request a limited time
duration (ssh-add -t 60, for 1 minute of storage), gpg-agent claims that it will respect my constraint

When i insert the key into the agent with ssh-add, i get a pinentry
prompt from gpg-agent, which wants to know "please enter a passphrase
to protect the received secret key $KEYNAME within gpg-agent's key
storage"), irrespective of the constraints i specify.

Using ssh-add -c, of course, i get message response "The user has to
confirm each use of the key" from ssh-add, meaning that the agent
responded affirmatively to the requested constraint.

If i use ssh-add -t 60, ssh-add prints the mesage "Lifetime set to 60
seconds", which also suggests that the agent has responded
affirmatively to the requested constraint.

however, if i then go to use the key via ssh after ssh-adding it
(whether or not i gave gpg-agent a key storage passphrase), the agent
uses the key *without* prompting for confirmation.  I believe it does
this until gpg-agent's passphrase-caching logic indicates an expiration.

Further, gnupg-agent appears to interpret the "lifetime" request to
correspond to a password cache duration request; the canonical
ssh-agent purges the key entirely from RAM (and never leaves it on
disk) at the lifetime expiry.  These are rather different experiences
and expectations, and probably shouldn't be conflated into the same
request syntax.

If gpg-agent is unable or unwilling to abide by the constraints
requested by the user, it should fail to add the key and indicate that
failure appropriately on the ssh-agent socket.