fix(security): constrain ProxyCommand endpoint token expansion #326

Problem

Cluster inventory endpoint data can alter a trusted ProxyCommand shell program. Config::resolve_nodes (src/config/resolver.rs:32-95) accepts detailed YAML host/user values without the CLI node validators. ProxyCommandConfig::expand (src/ssh/tokio_client/proxy_command.rs:87-119) substitutes %h/%n/%r/%k verbatim; spawn_proxy_command then invokes the shell (:287-296, :368-375). Both files are unchanged from the base of PR #325, so this is a pre-existing boundary, not a new regression.

Confirmed locally on macOS during #325 validation: an isolated cluster inventory hostname containing a harmless shell command substitution created a temporary marker through a separate trusted config containing ProxyCommand cat %h. The SSH connection subsequently failed; the marker already existed. The inventory contained only endpoint data, not a ProxyCommand directive. No user configuration or source files were modified. Evidence is retained at /var/folders/4b/th8tfjp17dg73fk3b2_0zk_c0000gn/T/bssh-proxy-boundary-ksxns0b3/result.json with the exact command, temporary inputs and output.

This requires control over inventory/token values used with an enabled trusted ProxyCommand; it is not evidence of an unauthenticated remote-server exploit. Assess the trust expectations for environment-derived inventory and public client APIs as well.

Acceptance criteria

• Enforce a consistent token-data boundary across CLI, cluster/YAML, environment and library paths before local shell execution.
• Preserve intentionally authored ProxyCommand shell syntax without allowing endpoint values to introduce shell syntax or arguments.
• Add no-side-effect regressions for host/user/alias tokens, including whitespace and shell substitutions.
• Document any compatibility restrictions and verify legitimate IPv6, aliases and proxy pipelines still work.

Follow-up to #314 and the security review of #325; this concern was not fixed by that progress PR.