A test pins the SSH version exchange: junk lines before the banner are bounded, and a slow or endless pre-banner stream is cut off #7184

The SSH transport (src/ssh/transport.ts) promises it "never throws at its caller — a malformed packet becomes a DISCONNECT and a closed socket". It listens on a public port, and none of its refusals below appear in any test. It tolerates a limited amount of pre-banner junk before giving up.

Done:

• [ ] A new test sends a few junk lines and then a valid SSH-2.0-… line, and the exchange proceeds.
• [ ] Junk past the transport's limit (lines or bytes, whichever it states) ends the connection without the server allocating more than that limit.
• [ ] A version line that is not SSH-2.0 (for example SSH-1.5-x) is refused.
• [ ] A peer that sends nothing is closed by the transport's timeout, and the test injects a short timeout rather than sleeping.

Files: test/ssh-version-exchange.test.ts

Drive src/ssh/transport.ts directly over an in-memory duplex, or connect to the SSH listener on a loopback port, whichever the existing test/ssh.test.ts makes easier. If the test finds the behaviour wrong, fix the transport in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit, the new test and test/ssh.test.ts.