feat(P3): Wave H — SSH/Linux adapter via Relay Agent (REQ-021, REQ-026 full)
Read-only SSH/Linux adapter with defense-in-depth:
- Broker layer-1 whitelist validation (TS, 6-command subset, independent impl)
- Relay Agent layer-2 CheckCommand (Go, G-004 contract unchanged, deny list +rm)
- No-shell exec.Command (split argv, third enforcement layer)
- tool_call WebSocket message + reader goroutine restructure (G-021)
- Cross-layer divergence matrix (G-013): all 4 cases pass
- M1-relay-WS regression: register/ping/pong preserved
Tests: 396 TS + Go tests green. Coverage: 96.73% on ssh adapter.
M1 non-regression: all M1 tests pass.
---ci---
phase: 3
milestone: v0.2
status: complete
wave: H
phase_role: execution
---/ci---
CIAgent
40066dfb0e