The update-environment option lists variables that tmux copies from the attaching client into the session environment, and it includes SSH_AUTH_SOCK, SSH_CONNECTION, and DISPLAY by default. The copy applies to the session environment, which is inherited by panes created afterwards. Shells already running in existing panes keep the value they were started with, so after reconnecting over SSH the old agent socket path is dead and every git push in an old pane fails with 'Permission denied (publickey)'.
Confirm by comparing 'echo $SSH_AUTH_SOCK' in an old pane with 'tmux show-environment SSH_AUTH_SOCK'.
The standard fix is a level of indirection. On the server, have the SSH session symlink the real socket to a fixed path such as ~/.ssh/ssh_auth_sock, then set SSH_AUTH_SOCK to that fixed path in the shell startup files and remove it from update-environment. Every pane then reads a path that stays valid across reconnects. An immediate workaround in one pane is 'eval "$(tmux show-environment -s SSH_AUTH_SOCK)"'.