feat(remote): add ssh port forwarding tool

[luoye520ww]

Summary

• Adds a remote_port_forward tool for SSH-bound remote threads.
• Opens loopback-bound SSH tunnels and waits until the local URL is actually ready before returning.
• Tracks tunnels per thread and cleans them up on thread dispose and runtime shutdown.

Dependency

Depends on KunAgent#672 for remote-bound thread execution and RemoteTargetRegistry. This is stacked on codex/remote-target-core to avoid repeating the KunAgent#672 runtime/tools diff.

Safety

• Only advertised/executable for SSH remote threads.
• localPort is omitted/0 for auto allocation or constrained to 1024-65535.
• remotePort must be 1-65535.
• Local bind stays 127.0.0.1.
• Production targets require explicit approval even when approvalPolicy is auto.
• Tunnel teardown sends SIGTERM, then escalates to SIGKILL.

Tests

• npm.cmd --prefix kun test -- src/remote/ssh-port-forward.test.ts src/remote/remote-port-forward-manager.test.ts src/adapters/tool/remote-port-forward-tool.test.ts
• npm.cmd --prefix kun run typecheck
• git diff --check