Run every command on the build VM over SSH (M1.3)

execution.SSHHost.execute is now the only way the agent runs anything
(L13). Commands travel as a script on SSH's stdin, so the secrets handed
to a call are never on a command line, and every value handed out is
redacted from the output. Timeouts kill the remote process group, and
an unreachable host is reported as such, not as a failed command.

Workspace and GitRepo run on the build VM. The clone uses the
repository's SSH URL, so no credential is stored in it (#89); fetches
and pushes get the push key over stdin, in a short-lived ssh-agent,
and PRs are still opened from the agent's host with its API token.
The bench runs on the build host too.

Tests reach "the build VM" through a throwaway local sshd (nisse_dev
.testing); CI installs openssh-server. The live push test now pushes
with the sandbox's deploy key (NISSE_PUSH_KEY).

Fixes #89.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PPQ14L3LikyefCMFBqEbKE

tests/integration/test_delegation_live.py

@@ -7,6 +7,7 @@ from pathlib import Path
 import pytest
 
 from nisse_dev.delegation import Caps, Delegation
+from nisse_dev.execution import SSHHost
 from nisse_dev.git import GitRepo
 from nisse_dev.llm import AnthropicPassthroughClient
 from nisse_dev.oplog import OpLog
@@ -23,9 +24,13 @@ it, and run `python -m pytest test_slugify.py -q` until it passes."""
 
 
 def build(
-    tmp_path: Path, caps: Caps, client: AnthropicPassthroughClient, model: str
+    ssh_host: SSHHost,
+    tmp_path: Path,
+    caps: Caps,
+    client: AnthropicPassthroughClient,
+    model: str,
 ) -> tuple[Delegation, GitRepo, StateStore]:
-    repo = GitRepo(tmp_path / "work")
+    repo = GitRepo(ssh_host, tmp_path / "work")
     repo.init()
     repo.configure_identity("nisse-dev-testing", "n@t.test")
     (repo.root / "README.md").write_text("sandbox\n")
@@ -34,7 +39,7 @@ def build(
     delegation = Delegation(
         client,
         store,
-        Workspace(repo.root, timeout_s=60),
+        Workspace(ssh_host, repo.root, timeout_s=60),
         repo,
         model=model,
         caps=caps,
@@ -43,10 +48,13 @@ def build(
 
 
 def test_delegate_completes_a_scoped_subtask(
-    tmp_path: Path, passthrough: AnthropicPassthroughClient, live_model: str
+    tmp_path: Path,
+    passthrough: AnthropicPassthroughClient,
+    live_model: str,
+    ssh_host: SSHHost,
 ) -> None:
     delegation, repo, store = build(
-        tmp_path, Caps(turns=12, wall_clock_s=300.0), passthrough, live_model
+        ssh_host, tmp_path, Caps(turns=12, wall_clock_s=300.0), passthrough, live_model
     )
 
     result = delegation.run(
@@ -66,19 +74,22 @@ def test_delegate_completes_a_scoped_subtask(
 
     # The delegate's own work is on its branch, and it really runs.
     assert repo.current_branch() == "live/delegation-1"
-    check = Workspace(repo.root, timeout_s=60).run_command(
+    check = Workspace(ssh_host, repo.root, timeout_s=60).run_command(
         "python -m pytest test_slugify.py -q"
     )
     assert check.success, f"delegate's own tests do not pass: {check.result[:400]}"
 
 
 def test_a_cap_breach_discards_the_work(
-    tmp_path: Path, passthrough: AnthropicPassthroughClient, live_model: str
+    tmp_path: Path,
+    passthrough: AnthropicPassthroughClient,
+    live_model: str,
+    ssh_host: SSHHost,
 ) -> None:
     # One turn cannot finish the brief, so this exercises the abort path
     # against a real model rather than a scripted one.
     delegation, repo, store = build(
-        tmp_path, Caps(turns=1, wall_clock_s=120.0), passthrough, live_model
+        ssh_host, tmp_path, Caps(turns=1, wall_clock_s=120.0), passthrough, live_model
     )
 
     result = delegation.run(