Run every command on the build VM over SSH (M1.3)

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

nisse-dev.example.yaml

@@ -9,9 +9,15 @@
 #   silently doing nothing.
 
 state_db: ~/nisse-demo-workspace/state.db
-workspace: ~/nisse-demo-workspace/project  # the clone
+workspace: /root/work/demo           # the clone, on the build host
 project: demo
 
+build_host:                          # L13: every command runs here, over SSH
+  address: build-demo.example
+  key: ~/.ssh/nisse-dev              # the agent's key for the build host
+  # user: root
+  # port: 22
+
 llm:                                  # L9: LiteLLM is the only LLM destination
   base_url: http://litellm.example:4000
   token: ${NISSE_LLM_TOKEN}
@@ -41,6 +47,7 @@ gitea:                                # D4, D5
   repo: owner/demo-repo
   operators: [your-gitea-login]
   base_branch: main
+  push_key: ~/.ssh/push-demo-repo    # a deploy key with write access (D4)
 
 # What each knob does, and how to choose a value: docs/Tuning-Guide.md.
 # These are the defaults; the section can be left out entirely. The file is