[git-ssh] SSH git transport (russh) sharing the pure-Rust responder core (SP2/A9)

[rawkode]

Add SSH git transport (spec A9/SP2) so clone/fetch/push work over SSH, driven by the same pure-Rust responders the smart-HTTPS path uses.

Approach

• russh server (host key from state/host_ed25519, not random).
• Impl server::Handler: auth_publickey(user, key) -> map SSH public key to identity/permissions (spec A5: pubkeys in admin config).
• Handle channel_exec for git-upload-pack '/repo.git' / git-receive-pack '/repo.git' (NOT shell/data), validate+authorize the repo, bridge channel stdin/stdout to the responder, set exit-status.
• Prereq refactor: extract a transport-neutral responder core from crates/git-http (today the upload-pack/receive-pack responders are axum-Response-shaped). Both the axum handlers and the SSH channel_exec then call the shared byte-in/byte-out core.

Reference

russh echoserver.rs is a useful skeleton for the server bootstrap + auth_publickey, but it only demos shell data echo — it has NO channel_exec, which is the git path. The git-specific exec parsing + responder bridging + exit-status is the real work.

Sequencing

After push+PAT (HTTPS) lands. Pairs with the credential model; SSH pubkey auth is an alternative to the cry credential helper (#128) for git.