feat(ssh): discover hosts and explicitly launch SSH workspaces

[denis-berezutskiy]

Adds Connect via SSH… to the sidebar. Users can choose a literal alias from
~/.ssh/config or enter [user@]host and an optional port, then explicitly
launch an interactive OpenSSH connection in a new workspace.

This is slice 1 of the SSH proposal in #135, following the maintainer's requested
split. Discovery only reads config text; OpenSSH resolves the selected alias on
connect. Input validation and argument quoting prevent options or shell syntax
from being injected through the dialog. The terminal uses xterm-256color so
remote Ghostty terminfo is unnecessary. The command buffer remains owned until
the surface is freed: the embedded Ghostty revision borrows that buffer during
startup, so releasing it after surface creation could corrupt the command.

The launch command is transient. Ordinary layout/title persistence remains, but
restoring a workspace or creating another tab/split does not automatically
connect. No tmux setup, reconnect, transfer, notification provisioning, or helper
installation is included. The picker does not enumerate Include files; their
aliases work when entered manually. Host-book editing remains deferred.

Validation:

• ./scripts/check.sh: formatting, workspace clippy with warnings denied,
  workspace tests, and packaging/shell regressions passed.
• Focused tests cover config aliases/comments/quoting/equals syntax, invalid
  destinations and ports, alias-preserving argv, and IPv6.
• LIMUX_SMOKE_PROFILE=debug ./scripts/xvfb-smoke-test.sh: passed, including a
  live SSH launch fixture checking argv, PTY, TERM, and non-persistence.

[bvolpato]

The SSH picker can offer a different destination from the one in ~/.ssh/config. config_words treats every unquoted # as a comment, but OpenSSH accepts Host foo#bar as a literal alias. With HostName example.invalid, ssh -G foo#bar resolves to example.invalid, while ssh -G foo resolves to foo. This parser shows foo, so selecting it can connect to the wrong machine. Please recognize comments only at token boundaries, then either support this alias or skip it rather than synthesizing foo.