chore(deps): pin SSH.NET 2026.0.0 to clear GHSA-q939-rpr3-3284

[mforce]

What

Adds a direct SSH.NET 2026.0.0 reference to Cluckwork.Api.IntegrationTests so the transitive pin lifts off the vulnerable version, and regenerates the lock files.

Why

The NuGet half of the #146 vulnerability gate is failing on main — run 31612525602:

[nuget] high — SSH.NET@2025.1.0 — GHSA-q939-rpr3-3284 — transitive
[nuget] 1 advisory at or above "high".

GHSA-q939-rpr3-3284 is high severity — ScpClient's recursive download honours server-controlled SCP filenames, allowing an arbitrary file write. Affected <= 2025.1.0, fixed in 2026.0.0.

Dependabot cannot fix this one. SSH.NET arrives transitively via Testcontainers 4.13.0, which is the latest release and still declares SSH.NET 2025.1.0 — there is no upstream bump to propose, so re-running the update job produces nothing. A direct reference in the consuming project is the only lever that moves the resolved version.

Exposure

Low, and this is gate hygiene rather than a live vulnerability:

• Cluckwork never calls ScpClient; Testcontainers reaches SSH.NET only for remote/SSH Docker hosts, and the fixtures use a local daemon.
• The dependency is test-only — it is not in any shipped artifact.

But the gate scans transitives and fails closed by design, so it blocks every unrelated PR until the resolved version moves.

Collateral

Lock files were regenerated solution-wide so all five agree (CI restores with --locked-mode). The floating version ranges re-resolved; everything is patch or minor:

Package	From	To
ASP.NET Core / EF Core	10.0.10	10.0.11
Newtonsoft.Json	13.0.3	13.0.4
BouncyCastle.Cryptography	2.6.2	2.7.0 (required by SSH.NET 2026.0.0)

The runtime base image already moved to .NET 10.0.11 in #518, so the managed packages now match it.

Verification

• dotnet build Cluckwork.sln — 0 warnings, 0 errors
• dotnet test Cluckwork.sln — 1637 passed, 0 failed, including 1167 integration tests against real Testcontainers/Docker, which is what exercises SSH.NET 2026.0.0 at runtime
• The gate itself: dotnet list package --vulnerable --include-transitive piped through .github/scripts/vuln-gate.mjs now reports no advisories at or above "high" (0 excepted, 0 below threshold) and exits 0

No migration, no user-visible behaviour change — no schema-doc or GLOSSARY/Help update applies.

Follow-up

Drop the direct reference once Testcontainers itself depends on SSH.NET >= 2026.0.0. The <PackageReference> carries a comment saying so.