Complete SSH transport release audit (#118)

AGENTS.md

@@ -13,6 +13,12 @@ entering Git transport code. Builds without the `ssh` feature must still parse
 SSH endpoints and return a typed unsupported-transport error before connection
 or repository mutation.
 
+The SSH feature must keep its algorithm allowlist, strict known-host checking,
+single configured identity, bounded channel/diagnostic limits, and ambiguous
+push outcome rules in `crates/storage`. Do not add OpenSSH configuration,
+proxy commands, password or keyboard-interactive authentication, host-key
+bypasses, or frontend transport policy.
+
 The CLI, Ratatui, Iced, Swift, SwiftUI, AutoFill, and watchOS code may collect
 input, invoke the Rust API, and present Rust-provided state. They must not
 duplicate storage rules, derive domain state from display strings, or directly