feat(security): harden Git SSH and publish vulnerability SARIF

[richards-ensono]

Summary

• harden Git-over-SSH with explicit supported key exchange, cipher, MAC, host-key, and public-key authentication policy;

• warn, without rejecting or replacing the selected identity, when an SSH key is undersized or cannot be classified safely;

• add evidence-backed OpenSSF Best Practices answers and retain crypto_keylength as Unmet because warnings do not disable undersized keys;

• emit govulncheck SARIF and upload it to GitHub code scanning for GitHub-managed triage, mitigation, and risk acceptance.

• move shared coding-agent guidance into root AGENTS.md and rename the project automation skill to .agents/skills/task-runner, including the verified rootless Podman DOCKER_HOST / EIRCTL_DOCKER_HOST setup.

Validation

• go test ./...
• go run -race cmd/main.go run lints with the verified rootless Podman socket (DOCKER_HOST and EIRCTL_DOCKER_HOST)
• go test ./scripts/check-workflow-policy
• scripts/check-immutable-ci-dependencies.sh
• openspec validate improve-openssf-crypto-analysis --json
• pre-commit run --all-files

Compatibility and risk posture

• Existing SSH identity selection, parsing, known-host verification, and explicit StrictHostKeyChecking=no behavior are retained.
• Servers or identities requiring excluded legacy algorithms can no longer authenticate.
• crypto_keylength remains Unmet: weak keys are only warned about, not blocked.
• Docker/Moby vulnerability findings are emitted in SARIF and triaged in GitHub code scanning; the current non-exploitable code-path assessment is documented in Docker dependency CVE assessment (CVE-2026-42306, CVE-2026-41567, CVE-2026-41568, CVE-2026-33997, CVE-2026-34040) #95.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
82.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dnitsch]

if possible can we change this package to be config_test and change this struct hardenedGitSSHAuth to be public - it's in an internal package so it's never exported outside the module - all the methods on it are public and it would be easier to maintain tests only tested via a public API

[dnitsch]

this will be replaced by trivy anyway in this PR #165 as the go vuln checker is a bit bare and limiting in terms of outputs and filtering capability