feat(hex-ssh): Add SFTP interop integration matrix

[levnikolaevich]

Context

hex-ssh-mcp now has a materially stronger transfer engine, but correctness is still proven mostly by local smoke tests and mocked SFTP behavior.

Before expanding feature breadth further, we need evidence that the current upload/download path behaves correctly across real servers and across both OpenSSH extension and fallback paths.

This is the first follow-up after #36.

Why first

• ssh2 durability extensions are optional, not universal
• current confidence is high locally, but cross-server evidence is still thin
• directory transfer, audit interpretation, and backend strategy are all safer after real interop coverage exists

What to do

• Build an integration matrix for ssh-upload and ssh-download
• Cover at minimum:
  • OpenSSH SFTP with OpenSSH durability extensions available
  • a second SFTP backend with different behavior and no OpenSSH durability extensions
• Validate:
  • overwrite reject / replace paths
  • recursive remote mkdir
  • timeout behavior
  • verification failures
  • durable finalize with extension fallback
  • local allowlist and remote allowlist behavior
• Add repeatable CI-friendly fixtures or containers where feasible
• Document observed backend differences and supported guarantees

Schema/API changes

• No public tool schema changes required
• May need test harness/config additions for integration targets

Definition of Done

• At least two real SFTP backends are covered
• OpenSSH extension path is tested
• Non-extension fallback path is tested
• Upload/download failure modes are exercised against real servers
• Results are documented so future regressions are easy to interpret

Related issues

• Built on: #36
• Unblocks / informs: #37, #39, #40, #41

Priority

Highest follow-up priority. This is the key evidence gap still missing.