Run every command on the build VM over SSH (M1.3)

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev/tests/test_gitea.py

@@ -1,5 +1,4 @@
 import json
-from pathlib import Path
 
 import httpx
 import pytest
@@ -200,7 +199,6 @@ def test_intent_without_a_branch_is_unverifiable() -> None:
 
 def test_closing_comments_first_then_closes_issue_and_pr() -> None:
     from nisse_dev.approvals import PlanBoard
-    from nisse_dev.git import GitRepo
     from nisse_dev.publish import MilestonePublisher
 
     seen: list[tuple[str, str, dict]] = []
@@ -220,10 +218,8 @@ def test_closing_comments_first_then_closes_issue_and_pr() -> None:
         None,  # type: ignore[arg-type] -- closing touches neither store nor git
         gitea,
         "o/r",
-        GitRepo(Path(".")),
-        base_url="https://gitea.test",
-        account="bot",
-        token="tok",
+        None,  # type: ignore[arg-type]
+        remote_url="ssh://git@gitea.test/o/r.git",
     )
     publisher.close_pull_request(20, "abandoned by don")