#3818 scanFleet: support a different SSH user per host (user@host entries)

Problem

The @swamp/cve/* scanners (dirtyfrag, emudhra, php-rce-2026-10) take a single global sshUser (and sshKey). scanFleet takes hosts as a comma-separated list and connects to each one as that same user:

• dirtyfrag_detect.ts (v2026.10.22.2): args.hosts.split(",") (around line 818), then each host gets sshUser: g.sshUser (around line 835). The target is built as ${g.sshUser}@${g.targetHost}.
• emudhra_detect.ts (v2026.10.22.1) builds ${g.sshUser}@${g.targetHost} the same way.

A real fleet often has a different login on each host; ours uses one username on Ubuntu and another on macOS. In that case scanFleet can't be used. The workaround is one behavior per host per scanner, eight in our case, each run as its own workflow step. That's the N-separate-runs pattern fan-out methods exist to avoid.

Proposed solution

Any of these would do:

• Accept user@host entries in hosts, using the entry's user when present and the global sshUser otherwise.
• Accept hosts as an array of { host, sshUser?, sshKey? } objects.
• Read hosts (and their users) from an existing @swamp/ssh inventory behavior.

user@host is the smallest change and fits the existing string input. Since all three scanners share this layer (see #3772's "shared CVE layer"), one fix could cover them all.

Alternatives

Per-host behaviors work, but they multiply definitions and give up the fan-out report across hosts.