fix(ssh): avoid remote tar metadata failures during file sync

[zwcf5200]

Summary

Fix SSH bulk file sync so tar extraction does not fail when remote tar tries to restore metadata for parent directories such as /, /home, or ..

The previous bulk upload archived the whole staging root with tar ... -C <staging> . and extracted it at / on the remote host. On macOS, bsdtar can also emit libarchive xattr metadata. In SSH profiles this produced warnings/errors like:

file_sync: sync failed, rolled back state: tar extract over SSH failed
tar: ./home: cannot utime: Operation not permitted
tar: .: cannot utime: Operation not permitted
tar: Ignoring unknown extended header keyword LIBARCHIVE.xattr...

Changes

• Archive only the explicit file entries using a tar manifest instead of archiving the staging root.
• Keep the existing symlink staging approach for preserving remote paths.
• Disable macOS archive metadata with --no-xattrs and COPYFILE_DISABLE=1.
• Add regression coverage for manifest-based SSH bulk upload.

Related

Related to #10205. That PR scopes extraction to .hermes; this change additionally avoids archiving parent directory entries and suppresses macOS xattr metadata that can break remote extraction.

Testing

• source venv/bin/activate && scripts/run_tests.sh tests/tools/test_ssh_bulk_upload.py tests/tools/test_file_sync.py
• source venv/bin/activate && uv run --active ruff check tools/environments/ssh.py tests/tools/test_ssh_bulk_upload.py
• Manual SSH verification against a remote profile: terminal_tool("pwd") returned /home/ubuntu/workspace with no file_sync: sync failed tar/utime warning.

[alt-glitch]

Related to #10205 (SSH bulk sync extraction scope). This PR additionally avoids archiving parent dir entries and suppresses macOS xattr metadata.

[alt-glitch]

Related to #10205