#2604 ssh: tailscale forward and sshExtraArgs fail - tailscale ssh rejects any flag before the destination

Extension: @swamp/ssh. Found while triaging swamp-club #2561. The tailscale ssh CLI (checked on 1.102.4) defines no flags of its own and rejects anything before the destination with: flag provided but not defined. Two argv builders put flags there: (1) tailscaleForwardArgv in ssh/extensions/models/_lib/forwarding.ts builds 'tailscale ssh [sshExtraArgs] -N -L spec user@host', which fails with 'flag provided but not defined: -N', so the forward method cannot work for kind: tailscale hosts. (2) buildExecArgv (runner.ts) and tailscaleForwardArgv both splice transport.sshExtraArgs before the destination, so any non-empty sshExtraArgs fails the same way (the runner_argv_test fixture uses --accept-risk, which tailscale ssh also rejects). tailscale ssh does pass everything after the destination to the system ssh, and OpenSSH re-parses options after the host, so 'tailscale ssh -- user@host -N -L spec' and 'tailscale ssh -- user@host -- ' are the working shapes. Repro without a tailnet: put a fake ssh script on PATH that prints its argv, then run 'tailscale ssh -N -L 8080:localhost:80 deploy@x'.