feat(gateway): allow ssh stdio transports

[elibosley]

Summary

Labby now accepts SSH as a direct stdio transport, so remote MCP services do not need the env wrapper workaround.

Why This Exists

The stdio spawn guard rejected /usr/bin/ssh because ssh was not in the built-in command list. Users had to hide SSH behind an allowlisted env command, which made the transport unclear and broader than necessary.

Resolution

Add ssh to the built-in stdio command allowlist. The existing basename check accepts both ssh and absolute paths such as /usr/bin/ssh. Keep the current argument and environment validation in place.

Reviewer Considerations

• SSH remains on the existing admin-gated stdio execution path.
• This change enables the command. It does not rewrite existing local configuration or install a remote SSH service.
• Existing env-wrapped configurations remain compatible.

Behavior Changes

• /usr/bin/ssh and ssh pass the stdio command guard.
• A remote MCP service can be configured with SSH as its direct stdio command.
• The gateway documentation and example config show the direct SSH form.

Implementation Summary

• Add ssh to ALLOWED_RUNTIME_HINTS.
• Add regression tests for an absolute SSH command and an SSH-to-MCP argument list.
• Document direct SSH stdio configuration.

Verification

• cargo fmt --all -- --check
• git diff --check
• cargo test -p labby-gateway security::spawn_guard::tests — 36 passed, 0 failed.
• Full gateway suite passed on the same change before the split: 877 passed, 5 ignored, 0 failed.

Risk

Low; the change reuses the existing admin-gated stdio path and keeps the current command, argument, and environment checks.

[jmagar]

@elibosley

Adding ssh to the built-in allowlist currently permits all SSH arguments, including local execution such as -o ProxyCommand=... and LocalCommand.

Can you add SSH-specific validation that rejects ProxyCommand, LocalCommand/PermitLocalCommand, -F, forwarding options (-L, -R, -D), agent/X11 forwarding, and control-socket options?