feat(mutagen): pair a host the first time we ssh into it

[gapul]

Decided operational policy for this module, now that the sync actually works (#177, #178):

• Which hosts sync: whichever ones we ssh into, provisioned on first contact rather than curated in peers.
• No failure notification, unlike restic. A stalled sync is noticed when a file does not turn up on the other side, which is the only moment it matters. mutagen sync list is the check.
• Not restic-backed up, unchanged. Nothing here is the only copy of anything.

Both of the last two are now written in the module header, because "we decided not to" is invisible otherwise.

How

ssh gets a zsh wrapper that passes the argv it was given to mutagen-sync-ensure, after the session ends and without touching ssh's own behaviour or exit code. Running it afterwards is deliberate: a second connection during the session would ask the Bitwarden agent to approve again, and on a host carrying port forwards it would fail outright (#177).

The script digs the destination out of argv the way ssh would, then declines to pair:

• raw addresses (*.*, *:*) — a one-off, and it would name the sync directory after something that changes
• *-sync — our own alias for a host peers already owns
• github, localhost

Identity is user_hostname_port from ssh -G, which resolves aliases locally, so rpi4 / rpi / raspberrypi collapse to one key instead of becoming three sessions pointed at the same remote directory:

rpi4           pi_100.69.79.75_22
rpi            pi_100.69.79.75_22
raspberrypi    pi_100.69.79.75_22

Pairing needs an unattended login: reachability and the remote parent directory are one ssh -o BatchMode=yes ... mkdir -p round trip, and a host that wants a password is skipped rather than left waiting on a prompt nobody can see.

Checked

Driven against stub ssh / mutagen binaries:

ssh macmini                          -> CREATE macmini
ssh -o ConnectTimeout=8 pve ls /tmp  -> CREATE pve
ssh gapul@rpi4                       -> CREATE rpi4
ssh -p 2222 ispc                     -> CREATE ispc
ssh 192.168.1.36                     -> (nothing)
ssh mvrx-nolang-dev-sync             -> (nothing)
ssh github                           -> (nothing)
ssh macmini   (second time)          -> (nothing)