Run every command on the build VM over SSH (M1.3)

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_delegation.py

@@ -22,6 +22,7 @@ from nisse_dev.delegation import (
     DelegationResult,
     delegation_reconciler,
 )
+from nisse_dev.execution import SSHHost
 from nisse_dev.git import GitRepo
 from nisse_dev.llm import BudgetExhausted, LLMError, UpstreamUnavailable
 from nisse_dev.oplog import OpLog
@@ -73,8 +74,8 @@ def store(tmp_path: Path) -> StateStore:
 
 
 @pytest.fixture
-def repo(tmp_path: Path) -> GitRepo:
-    r = GitRepo(tmp_path / "work")
+def repo(ssh_host: SSHHost, tmp_path: Path) -> GitRepo:
+    r = GitRepo(ssh_host, tmp_path / "work")
     r.init()
     r.configure_identity("bot", "bot@example.test")
     (r.root / "seed.txt").write_text("seed")
@@ -84,7 +85,7 @@ def repo(tmp_path: Path) -> GitRepo:
 
 @pytest.fixture
 def ws(repo: GitRepo) -> Workspace:
-    return Workspace(repo.root, timeout_s=10)
+    return Workspace(repo.host, repo.root, timeout_s=10)
 
 
 ITEM = "t"  # the work item these delegations run in