A test pins SSH key negotiation: no common algorithm, a client point of the wrong length, or an invalid curve25519 point fails the exchange #7183

The SSH transport (src/ssh/transport.ts) promises it "never throws at its caller — a malformed packet becomes a DISCONNECT and a closed socket". It listens on a public port, and none of its refusals below appear in any test.

Done:

• [ ] A new test offers only algorithms the forge does not support and gets KEY_EXCHANGE_FAILED with "no common algorithm".
• [ ] A Q_C of 31 or 33 bytes gets "bad Q_C length".
• [ ] An all-zero point and a known low-order point each get "invalid client point", and no shared secret is derived.
• [ ] Each case closes the socket, and the next connection is served.

Files: test/ssh-kex-negotiation.test.ts

Drive src/ssh/transport.ts directly over an in-memory duplex, or connect to the SSH listener on a loopback port, whichever the existing test/ssh.test.ts makes easier. If the test finds the behaviour wrong, fix the transport in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit, the new test and test/ssh.test.ts.