Complete SSH transport release audit (#118)

docs/git-synchronization.md

@@ -56,7 +56,8 @@ Encrypted-key passphrases come from `SecretBytes` in the operating-system
 secret store. Identity attempts are bounded and deterministic; IronStorage
 does not spray keys, use passwords or keyboard-interactive authentication,
 read OpenSSH configuration, start/probe an agent process, or run proxy/helper
-commands. SHA-1 host signatures and `ssh-rsa` authentication are excluded.
+commands. The explicit client allowlist excludes SHA-1 key exchange/MAC,
+RSA/SHA-1 signatures, DSA, CBC, `none`, compression, and host certificates.
 Cancellation interrupts connection and authentication without changing Git,
 known hosts, or secure storage.
 
@@ -122,3 +123,6 @@ quoting, cancellation, and rollback without an external Git or SSH executable.
 Frontend tests cover typed transport display, prompt masking and cancellation,
 retry routing, conflicts, authentication failures, and successful HTTPS
 regression paths without duplicating protocol logic.
+
+The final two-URL lifecycle, adversarial failure, dependency, target, and
+artifact matrix is maintained in `ssh-transport-audit.md`.