[codex] Pin patched SSH.NET across backend test harness

[SadPossum]

What changed

• centrally declares SSH.NET 2026.0.0 for the backend composition
• adds a private direct reference only to the non-packable tests/Integration.Tests project
• advances only the affected Framework, Access-Control, Administration, Auth, Notifications, Organizations, and Task-Runtime submodule pointers to their published security commits

Why

Testcontainers 4.12.0 permits SSH.NET 2025.1.0 or newer, so NuGet lowest-version resolution selected SSH.NET 2025.1.0. That version is affected by GHSA-q939-rpr3-3284. The direct test-project references select patched SSH.NET 2026.0.0 without enabling repository-wide transitive pinning or adding a production dependency.

Impact

Production code and package surfaces are unchanged. The composed test graphs now resolve SSH.NET 2026.0.0 and BouncyCastle.Cryptography 2.7.0.

Upstream dependencies

This draft must not merge until the upstream security changes are on each repository's dev branch and these gitlinks are refreshed to those merged dev heads:

• Framework solution-sync prerequisite: [codex] synchronize method-aware rate-limit task in solution GMA-Framework#23
• Framework security change: [codex] Pin patched SSH.NET in test harness GMA-Framework#25
• Access-Control: [codex] Pin patched SSH.NET in test harness GMA-Module-Access-Control#13
• Administration: [codex] Pin patched SSH.NET in test harness GMA-Module-Administration#12
• Auth: [codex] Pin patched SSH.NET in test harness GMA-Module-Auth#17
• Notifications: [codex] Pin patched SSH.NET in test harness GMA-Module-Notifications#13
• Organizations: [codex] Pin patched SSH.NET in test harness GMA-Module-Organizations#19
• Task-Runtime: [codex] Pin patched SSH.NET in test harness GMA-Module-Task-Runtime#15

Validation

• full solution restore: passed
• full serial solution build: 0 warnings, 0 errors
• full solution transitive vulnerability audit: no vulnerable packages
• Integration.Tests resolution: SSH.NET 2026.0.0, Testcontainers 4.12.0, BouncyCastle.Cryptography 2.7.0
• focused PostgreSQL migrations-host Docker smoke: 1 passed, 0 failed, 0 skipped
• repository security policy: passed
• repository release policy: passed
• staged and committed diff checks: passed

Existing baseline drift

• Framework source-package validation reports that Gma.Framework.slnx omits docs/architecture/method-aware-http-rate-limiting-task.md; this is present at both the backend's recorded Framework baseline and the requested security head. Framework PR #23 repairs it.
• root solution synchronization reports that BunkFy.slnx is already out of date on origin/dev; this dependency-only change does not modify the solution graph and intentionally does not absorb that unrelated repair.
• the submodule dev-head gate is expected to remain red while these draft upstream commits are not yet on their repositories' dev branches.

[SadPossum]

Superseded by the equivalent consolidated backend security fix already landed on dev in 2f4833a, together with current module/framework pointers. Closing this draft so the Properties work can rebase onto the clean canonical dependency graph.