fix(ssh): dial a fresh connection on reconnect so group changes refresh

[netcatty-bot]

Summary

• Manual and auto reconnects of an SSH terminal now always dial a brand-new connection instead of borrowing the live or idle-parked pooled transport for the same endpoint.
• The reconnect path in the terminal pane sets a persistent fresh-connection flag; the SSH starter turns it into the existing reuseTransport: false bridge option, so the main process skips parked/idle/in-flight transport reuse and performs a full re-authentication (same mechanism "Duplicate Session" already uses).

Why

OpenSSH applies supplementary-group membership at login. A new shell channel multiplexed onto an already-authenticated connection keeps the groups captured when that connection was authenticated, so after usermod -aG sudo <user> on the remote host, reconnecting in Netcatty (or auto-reconnect after an idle TMOUT logout) still showed the old id output until the whole app was quit, which tears down the pooled transports. Verified against a local OpenSSH server: id through a reused master connection stayed stale, while a fresh connection showed the new group.

Changes

• components/Terminal.tsx: add a requireFreshConnectionOnReconnectRef; startReconnect sets it before the retry starts so every SSH attempt in that pane dials fresh from then on.
• components/terminal/runtime/createTerminalSessionStarters.ts: include the reconnect flag in the reuseTransport: false decision (alongside the existing automation / Duplicate-Session / reuse-fallback cases).
• components/terminal/runtime/createTerminalSessionStarters.types.ts: type the new optional context ref.
• New-tab Copy/Split reuse (issue 功能缺陷 #1204), SFTP and port-forwarding transport sharing are untouched.

Testing

• node --test --import tsx components/terminal/runtime/createTerminalSessionStarters.test.ts (new test: reconnect flag forces reuseTransport: false, ordinary opens unaffected) — pass.
• node --test --import tsx application/state/terminalReconnectRegistry.test.ts components/terminal/TerminalView.test.tsx — pass.
• npx eslint on the touched files — clean; tsc --noEmit error count for the touched files unchanged from baseline.
• Manual repro against a local sshd confirmed a fresh login reflects usermod -aG while a multiplexed connection does not; Netcatty UI behavior itself not manually exercised.

Fixes #3293

Automation

• Automated implement pass
• Review gate: @codex review (own/bot PRs only)
• Draft until Codex reports clean findings

[binaricat]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-06T09:35:04.280370Z	bef677d	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: bef677d9c5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[netcatty-bot]

Codex reported no major issues. This PR is marked ready for human review/merge.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bef677d9c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Let reconnect freshness override pending source reuse

When a Copy/Split pane is disconnected before its first SSH attempt consumes reuseConnectionFromSessionIdRef—for example, while encrypted key hydration is awaiting—its reconnect still carries a sourceSessionId. This leading !sourceSessionId condition then ignores the new reconnect flag, allowing the bridge to reuse the source's already-authenticated transport and skip the fresh login this change promises. Clear the source intent when reconnecting or let requireFreshConnectionOnReconnectRef override source reuse.

Useful? React with 👍 / 👎.