feat(remote): add guarded ssh target runtime core

[luoye520ww]

Summary

• Reintroduce the SSH remote target runtime core on the current develop baseline.
• Keep this PR scoped to backend/runtime support only: no picker UI and no port-forward tool.
• Prime per-thread remote targets before each turn and evict cached bindings when a thread is cleared, archived, or deleted.
• Close protected-path, command-classification, abort, and missing-outcome gaps found during the follow-up review.

Why this is split from the reverted remote feature

#690 reverted the earlier SSH Remote work because the product surface was not mature enough for release. This PR keeps only the guarded runtime foundation; Picker UI and Port Forward remain separate follow-up PRs.

Safety and reliability

• resolve relative file/search paths against an absolute remoteDir before protected-path checks
• classify pipe-to-shell commands as state-changing and require confirmation outside observe mode
• deny full or sensitive environment dumps instead of treating them as read-only
• never probe or execute an already-aborted command
• mark authentication/precheck failures with exitCode: null as tool errors
• avoid applying remoteDir twice during SSH precheck
• keep SSH subprocesses hidden on Windows
• retain bounded output, SIGTERM-to-SIGKILL escalation, atomic stdin writes, edit CAS, and no replay for mutating commands

Tests

• npm.cmd --prefix kun test -- src/remote/remote-command-risk.test.ts src/remote/remote-profile.test.ts src/remote/remote-connection.test.ts src/remote/remote-hosts-service.test.ts src/remote/ssh-executor.test.ts src/adapters/tool/remote-file-tools.test.ts src/adapters/tool/remote-command-tool.test.ts (60 passed)
• npm.cmd run build:kun
• focused ESLint
• git diff --check

Full Kun typecheck is currently blocked only by the shared develop baseline tracked in #829; this branch adds no additional type errors after the production build.

[XingYu-Zhong]

感谢这次实现。当前 PR 暂不合入并关闭，原因如下：

1. 该改动跨越 agent loop、runtime factory、thread service、tool host 等核心路径，与当前 develop 的单 Kun runtime 架构已有多处实质冲突，无法安全地通过机械解冲突落地。
2. 当前主要是 SSH 后端核心，尚缺少完整、可用且可验证的目标选择与状态 UI，直接合入会留下不可达或半成品产品面。
3. 远程文件与命令执行显著扩大安全边界，需要独立的威胁模型、权限/审批策略和端到端安全测试；现有 3000+ 行跨 43 个文件的范围过大，不适合一次性审阅和上线。

建议后续基于最新 develop 重新拆分：先提交远程目标契约与安全模型，再分别提交连接管理、受控文件操作、受控命令执行和 UI，每个阶段提供独立测试与产品入口。关闭仅针对当前实现形态，不否定该方向。