A test pins SSH key-exchange order: anything before KEXINIT, a second KEXINIT, or ECDH_INIT or NEWKEYS out of turn is refused #7182

The SSH transport (src/ssh/transport.ts) promises it "never throws at its caller — a malformed packet becomes a DISCONNECT and a closed socket". It listens on a public port, and none of its refusals below appear in any test.

Done:

• [ ] A new test sends a non-KEXINIT message first and gets "expected KEXINIT first", with a PROTOCOL_ERROR disconnect.
• [ ] A duplicate KEXINIT, KEX_ECDH_INIT before KEXINIT, a second KEX_ECDH_INIT, and NEWKEYS outside a key exchange each end the connection with a disconnect, not a thrown error.
• [ ] The server never sends its host-key signature in any of these cases.

Files: test/ssh-kex-order.test.ts

Drive src/ssh/transport.ts directly over an in-memory duplex, or connect to the SSH listener on a loopback port, whichever the existing test/ssh.test.ts makes easier. If the test finds the behaviour wrong, fix the transport in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit, the new test and test/ssh.test.ts.