SSH pre-banner delay proof

Runtime evidence, not a test or mocked SSH process. Each side runs the unchanged
packages/ssh/src/command.ts from its own commit, using Node, Effect's NodeServices
and real OpenSSH against the VM's real local sshd. No app database is used.

Base: fd8e386f7f259070899553e55c99a2a49a378480
Head: a1c85a7d6cd2bdddcddc7b56c71cd379fb0d9c95

Install each checkout with vp i. Copy driver.ts into packages/ssh/proof.ts.
The driver imports that checkout's src/command.ts. Give SSH_PROOF_CONFIG the
absolute path to the supplied ssh-config and PROOF_SHA the checkout commit.
Run node packages/ssh/proof.ts from each checkout root. No credentials required.

The same synthetic ssh config supplies ConnectTimeout 120 and a ProxyCommand
which prints a synthetic SSO URL, waits 13 seconds, and relays to local sshd.
The fixture intentionally has no authentication key; Permission denied (publickey)
proves it reached normal authentication after the delay, not successful pairing.
The command budget is 60 seconds on both sides. Base aborts at 10 seconds during
banner exchange; head reaches normal authentication after 13 seconds.

record.sh captures the live terminal under headless-desktop, at 1920x1080,
10 fps, with the same dark theme and font. Its arguments are checkout root,
output directory, commit SHA, config path, terminal.sh path. terminal.sh runs the
same driver. Stills are checked for identical pixels 500ms apart. Videos retain
the elapsed waiting lines and actual OpenSSH stderr printed by the runtime.

Scope: command path used by desktop SSH launch/pairing. The full Electron
connection UI, retry loop, a real NetBird account and browser SSO link presentation
are not exercised. No test suite is presented as evidence.

AI-assisted; verified with the tests and tools listed above.