Server-opened channels are accepted, and the host startup command is never run #147

Tested against main (894ea12).

Channels opened by the server are accepted

SshHandler (core/src/connection.rs:116-172) only overrides kex_done and check_server_key. russh 0.63.3's default client handler (client/mod.rs:2470-2640) accepts, with reply.accept(), every channel a server opens towards the client:

• auth-agent@openssh.com
• x11
• forwarded-tcpip and forwarded-streamlocal
• direct-tcpip and direct-streamlocal
• session

Clavyn never requests agent or X11 forwarding or remote port forwards, so no legitimate server has a reason to open any of these. Nothing reaches a real agent or socket. But each accepted channel stays in the connection's channel table, nothing reads it, and Channel has no Drop that closes it. A malicious or compromised server can keep opening channels and grow client memory for as long as the session lives. OpenSSH refuses channel types it did not ask for.

The host startup command never runs

create_ssh_session (core/src/session.rs:201-208) sends startup_command as channel.exec(false, cmd) after request_shell on the same channel. A session channel accepts one shell, exec or subsystem request. OpenSSH processes them only while the channel is still "larval" (session.c, session_input_channel_req), so an exec after the shell is ignored. want_reply = false hides the refusal, and no test covers it.

There is no UI to set the field today, but it is part of the stored host and the import path. #122 already treats it as something a vault key can be used to run.

Fix

• Override every server_channel_open_* hook to reject(AdministrativelyProhibited).
• Write the startup command into the shell followed by \r, the same bytes the user would type.