Add managed provider to proof liskov ssh

[firegrass]

What changed

• dispatches canonical proof liskov ssh over the closed Tailscale/Liskov provider union
• requires a customer-owned Ed25519 identity for managed access and derives only its public key
• confirms and atomically pins signed host evidence in a Liskov-only mode-0600 known_hosts file
• mints a one-time ticket only after confirmation, passes it through an ephemeral mode-0600 file, and removes it on exit or signal
• invokes stock OpenSSH with strict pinning, identity isolation, and all forwarding disabled
• upgrades the hidden binary-only bridge to /v1 and liskov-access.v1
• keeps managed --print-command redacted and ticket-free

Why

Managed Runtime SSH needs a safe canonical operator path while leaving the existing Tailscale branch unchanged.

Coordination

Part of ADR-0045 / EPIC-20260803-b3ec / BKLG-20260803-de02. Merge only with the coordinated liskov-rs and runtime v0.7 changes green. This remains a private CLI dogfood feature.

Validation

• pnpm typecheck
• pnpm build
• pnpm test (128 tests)
• pnpm run pack:dry-run