Adds scope to ServerV2 in SSH heartbeats

[eriktate]

This PR adds scope validation to heartbeats and configures SSH servers to populate a scope value using the AgentScope found in its identity. Other server types do not yet populate a scope, so their scope validation during heartbeats will just verify that there is no scope

[github-actions]

Amplify deployment status

Branch	Commit	Job ID	Status	Preview	Updated (UTC)
eriktate/scoped-ssh-heartbeat	93e4c7b	14	✅SUCCEED	eriktate-scoped-ssh-heartbeat	2025-11-10 20:21:30

[rosstimothy]

@fspmarshall @espadolini should we add a scope field to all agent resources before this gets in a release - even if nodes will be the only resources that populate this field for the near future?

[eriktate]

should we add a scope field to all agent resources before this gets in a release - even if nodes will be the only resources that populate this field for the near future?

If the check on the scope of the agent can be done for all protocols, why not?

@rosstimothy @espadolini I added the scope field to the other server types, would you mind taking a quick peek before I merge? Just want a sanity check since proto changes aren't as easy to fix once they land

[espadolini]

Can older auth versions running concurrently with scope-aware ones cause permanent problems, or will they only grant too many permissions while they are running?

[espadolini]

Is the scope something that the agent needs to be aware of and tell the auth about (even if just for confirmation)?

[espadolini]

I think you should also add a check for the scope in services.CompareServers.