feat(executor): reuse SSH connections instead of dialing per command

[Kritoooo]

Summary

Previously both transports opened a fresh SSH connection (TCP dial + handshake + auth) for every command and closed it immediately. This PR adds connection reuse to both:

Native transport (golang.org/x/crypto/ssh)

• Connection pool: concurrency-safe per-executor pool keyed by resolved target shape (host, port, user, ProxyJump, identity files); concurrent dials for the same key are single-flighted, failures are broadcast to all waiters.
• Keepalive: keepalive@openssh.com heartbeat per pooled connection (default 30s, configurable) under a short timeout; a failed/hung heartbeat evicts and closes the client.
• Liveness: pooled NewSession is bounded by ConnectTimeout; session.Run is ctx-aware (closes transport on cancel, no command timeout). A stale pooled client is evicted and transparently re-dialed once — never after session.Run has started (double-execution risk).
• Concurrency safety: in-flight sessions are refcounted per pool entry; suspicious post-Run errors de-pool immediately but defer Close until in-flight sessions drain. MaxSessions channel-open rejections fall back to a one-off unpooled dial.
• ProxyJump closer chains are preserved; Close() drains the pool; Probe stays one-shot.

Shell transport (system ssh)

• OpenSSH multiplexing: ControlMaster=auto + ControlPersist=60s + per-target ControlPath under a stable per-user 0700 dir (UserCacheDir/agentssh/ssh-mux), so masters are reused across invocations; Close() leaves live sockets alone.
• ssh_config alias targets get no injected mux options — the user's ssh_config governs.
• Falls back to plain argv when the ControlPath would exceed the unix-socket sun_path limit.

Config & lifecycle

• New config keys: ssh.multiplexing, ssh.control_persist, ssh.keepalive_interval.
• Normalized OS is cached per host (pool entry / mux key) instead of re-probing uname -s every command.
• Close() error added to the Executor interface.

Review

The initial implementation went through a high-effort code review (8 finder angles, adversarial verification): 10 findings confirmed (3 CONFIRMED / 7 PLAUSIBLE) — including indefinite hangs on half-open pooled connections, a keepalive that itself blocked forever, evictions killing concurrent in-flight sessions, and orphaned ControlPersist masters. All 10 are fixed in the second commit, plus a ctx-cancel output-buffer data race caught by the race detector.

Testing

• gofmt -l . clean, go build ./..., go vet ./... pass
• go test -count=1 ./... — all packages green
• go test -count=1 -race ./... — full suite green under the race detector
• 20+ new tests: pool reuse, single-flight + error broadcast, dead-client reconnect, keepalive timeout eviction, in-flight-drain deferred close, MaxSessions fallback, ControlMaster argv, stable control dir surviving Close, alias non-injection, ControlPath length fallback, OS caching, config wiring.

🤖 Generated with Claude Code