#2554 ssh: env-forwarded variables are dropped by sudo env_reset for script and for programs run under sudo exec

Extension: @swamp/ssh. Found while fixing swamp-club #2336 (not introduced by it).

Variables supplied through host or per-call env reach the remote host via ssh SendEnv, so they exist only in the unprivileged login shell. When sudo: true is set, sudo applies env_reset (the default policy) and the escalated process starts without them:

• script with sudo: true runs sudo -n -- sh -s -- (or bash/python3) and streams the body on stdin. Any reference to a forwarded variable inside the script body expands to empty, because the escalated interpreter never received it.
• exec with sudo: true and a plain command (for example printenv APP, or a program that reads APP from its environment) runs the program without the variable. Only literal dollar-variable references in the command string were ever expanded, by the outer shell, before sudo ran.

#2336 fixes the case where the exec command string itself references a forwarded variable and gets wrapped in sh -c (it re-exports the forwarded keys through env). The script path and the program-environment case above are pre-existing and unchanged.

Suggested direction: apply the same env re-export (env with a set-only parameter expansion per forwarded key) to scriptRemoteCommand and to the plain-command sudo path, noting that restricted sudoers would then also need to allow env, or document that forwarded env does not cross sudo.