[codex] Pin patched SSH.NET in test harness

[SadPossum]

What changed

• centrally declares SSH.NET 2026.0.0
• adds a private direct reference only to the non-packable integration test project

Why

Testcontainers 4.12.0 requests SSH.NET 2025.1.0 or newer. NuGet lowest-version resolution selected SSH.NET 2025.1.0, which is affected by GHSA-q939-rpr3-3284. A direct test-project reference applies the patched version without enabling repository-wide transitive pinning or adding a production dependency.

Impact

Production module packages remain unchanged. The test harness now resolves SSH.NET 2026.0.0 and BouncyCastle.Cryptography 2.7.0.

Validation

• affected test project restore: passed
• affected test project build: 0 warnings, 0 errors
• direct and transitive vulnerability audit: no vulnerable packages
• resolved graph: SSH.NET 2026.0.0
• PostgreSQL Testcontainers smoke: 1 passed

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[SadPossum]

Superseded by the equivalent consolidated fix already landed on dev in 6f51cb3. Closing this draft to keep one active change path per repository.