Add comprehensive SSH integration tests covering:
- push creates repo on demand and clone round-trips match HEAD
- push rejected when disabled, repo not created
- clone of missing repository fails
- receive-pack hooks fire asynchronously after push response

Tests drive a real git client over ssh:// against an in-process
SSH server backed by memfs, generating ephemeral ed25519 client
keys and bypassing host key checking for CI environments. Helpers:
gitSSHEnv() configures GIT_SSH_COMMAND and isolation env vars,
gitWithEnv() runs git with custom env (callers can inspect errors),
startSSHServer() creates an in-memory daemon on an ephemeral port.

Assisted-by: Claude Sonnet 4.6 via Claude Code

Signed-off-by: Xe Iaso <me@xeiaso.net>

gliderlabs/ssh already stashes the connecting key for Session.PublicKey(),
so the pubKeyContextKey type and PublicKeyHandler SetValue call were
redundant. Read the key directly in handleSSH. Also relax the command
arity guard to len < 2 and document the intentional protocol-v2 omission.