#3581 Explicit pinned host-key policy, argv exec, atomic copy, and agent-based identityContent

Problem

A few hardening requests from using @swamp/ssh (checked against 2026.10.16.1) to manage hosts that are rebuilt often:

1. Host-key policy is implicit. strictHostKeyChecking is optional; when unset, no -o StrictHostKeyChecking is passed and behaviour falls back to whatever the runner's ssh_config says. The only pinning mechanism is knownHostsFile, a path to a file that must already exist on the runner. There is no way to supply the expected host key(s) as model data.
2. exec takes one shell string. command is a single string passed to the remote shell, so callers that build commands from data have to shell-quote every token themselves.
3. copy is a plain scp/rsync. The destination is written in place, so a reader on the remote side can see a partially written file, there is no way to set the final mode/owner as part of the copy, and nothing verifies what landed.
4. identityContent is written to a temp file. materializeTempKeys writes the private key to Deno.makeTempFile() (mode 0600) for the duration of the call. It is cleaned up afterwards, but the key does touch disk, and a crash can leave it behind.

Proposed solution

1. Add an explicit host-key policy, e.g. hostKeyPolicy: "pinned" | "accept-new" | "insecure" plus a hostKeys: string[] input (OpenSSH public-key lines; public data, so no sensitive marking needed). For pinned, write the keys to a per-call known_hosts file and pass StrictHostKeyChecking=yes and UserKnownHostsFile=<that file>. Making the policy required (or defaulting to pinned once hostKeys is set) would make the security posture visible in the definition rather than inherited from the runner. collect-host-public-key already produces the data this would consume.
2. Add an argv form, e.g. argv: string[] as an alternative to command, with each element POSIX single-quoted before it is joined for the remote shell.
3. An atomic: true option for copy ... direction: to: upload to a temp path next to dst, optionally chmod/chown (mode, owner inputs), optionally verify a sha256, then mv into place.
4. When an agent is available or can be started, load identityContent with ssh-add - over stdin into a short-lived per-call agent (ssh-agent -a <socket>, killed afterwards), and point ssh at it via IdentityAgent. Keep the temp-file path as a fallback.

Happy to split these into separate issues if that is easier to track.

Alternatives

Today callers can work around 1 by generating a known_hosts file before each run and passing knownHostsFile, 2 by quoting manually, and 3 by following copy with an exec that does mv/chmod/sha256sum. They work but every caller has to reimplement them.

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/ssh@2026.10.16.1
• swamp: 20261013.025835.0-sha.1b6f0c59
• OS: linux (aarch64)
• Deno: 2.9.7
• Shell: /usr/bin/zsh