> if an attacker had access to the server where Alice's ssh-agent is
forwarded to, and had an unprivileged access to Alice's workstation,

if at attacker has any access at all you should assume they have a root exploit laying around and will be using it