fix(ssh): recover Brev includes scoped to unrelated hosts

[deepujain]

When the Brev SSH Include is inside an unrelated Host or Match stanza, brev refresh finds its text and leaves the alias unresolved. Only an Include in global scope now counts as installed, so the existing insertion path prepends a global Include. Existing configuration is preserved, and subsequent refreshes do not rewrite it again. Unix and Windows path matching remain supported.

Related to NVIDIA/NemoClaw#13090 and its QA reproduction. This does not establish who originally misplaced the workstation Include.

The CI prerequisite #508 is merged and removes the enterprise-disallowed Slack action. Main already contains the auth-test expectation correction through #489. This candidate is synchronized onto main ed8f392377849b701c13a110dad78debbb8a10f4; the SSH patch is unchanged (verified with git range-diff), and the PR still changes only two SSH files.

Validation:

• Existing focused race regressions cover real OpenSSH routing recovery, unrelated settings, Unix/WSL idempotence and certificate templates. Those source-equivalent regressions pass on the repair and fail on the original base; their evidence is retained without repeating unchanged fixtures.
• Refresh, shell, mint-cert and sshcert integration race tests and native build pass on signed candidate 0c65a8fbe99b490739e4bc5e293db070b67f3ccb with the updated base and dependencies. Full upstream CI, release cross-build and repository reviews remain required on the new head.
• Formatting and diff checks pass. The previously observed local macOS JetBrains path failure occurs on both base and candidate; hosted Linux qualification remains required.

The retained QA workstation still needs the corrected CLI tested through both original Setup over SSH and Coding Agent paths, refresh/reconnect, onboarding and a real agent response. This PR does not claim production acceptance or publish a CLI release.

[deepujain]

Full qualification is currently blocked by existing main-branch CI failures. Linked prerequisite: #508 fixes the enterprise-disallowed notification action in the test workflow and stale HTTPResponseError assertions after merged #484. The SSH repair remains scoped to its two files.

GitHub has held the fork workflows for maintainer approval. A maintainer with Actions write authority needs to approve the runs on #508 and this PR. My account has read-only upstream access, so it cannot approve those runs or the code-owner review. No unchanged workflow reruns or new repair pushes have been triggered.

Published SSH candidate: ed93a09581f098b429018371ae5f33a7614cc7e8; base: a0190d24655f57f327778f7708d8a6f634afdb1a. GitHub verifies its signature. Focused race regressions, actual OpenSSH routing/preservation test, impacted package tests, package lint (zero findings), package vet, formatting and native build pass. Full upstream Linux CI and production QA acceptance remain pending; local results do not waive them.

[deepujain]

The CI prerequisite #508 merged as ed8f392377849b701c13a110dad78debbb8a10f4. This PR is now synchronized onto that main commit with signed, GitHub-verified head 0c65a8fbe99b490739e4bc5e293db070b67f3ccb.

The two-file SSH patch is identical to the previous candidate (git range-diff confirms this); no new product changes were added. Main also brings updated refresh/mint-cert integration and generated dependencies, so I requalified refresh, shell, mint-cert and sshcert with go test -race -count=1; all pass. The native build passes and records this exact revision with vcs.modified=false. Existing source-equivalent OpenSSH regression and preservation/idempotence evidence is retained.

All eight normal upstream workflows were created for the new head and report action_required, with zero jobs or artifacts so far. Full CI, release cross-build and repository review remain pending. Existing maintainer approval coordination remains in place; no manual reruns or permission bypass were used.

Production QA acceptance for NVIDIA/NemoClaw#13090 remains separate: both original UI setup paths, refresh/reconnect, host/provision/adapter checks, onboarding and a real agent response still need confirmation.

[deepujain]

Qualification update for approved head 0c65a8fbe99b490739e4bc5e293db070b67f3ccb against main ed8f392377849b701c13a110dad78debbb8a10f4: full test, legacy tests and release cross-build, build, lint (zero findings), fmt, vet and CodeQL pass. Logs and available artifacts/annotations inspected. The merge-ref source 063e66531b201516c26f16f8915caf4c0dcdec6e has exactly that base/head as parents. Cross-build passed Linux/Darwin amd64/arm64 using goreleaser-cross v1.24.5, digest sha256:a5a915aa72e9f92acd6fe481a73fa1da1255d96f57b62678b3106a27165109ed; publishing is skipped by the existing workflow.

The one failing check is CLI Output Compatibility, attempt 2: Test_VersionCommandOutputFormat finds no X.Y.Z in go run main.go --version. The same pkg/integration package passes in both full-suite jobs on this exact head (6.793s and 17.315s). The exact-base compatibility run passes too. Relevant test/version/release/command sources are byte-identical between base and candidate. An unsuccessful live GitHub releases lookup can leave the development version output without a number; the failed log does not capture its HTTP result, so a specific network/rate-limit cause is not confirmed.

Please rerun only the failed compatibility workflow once to check this intermittent failure. I have no upstream Actions write authority. The approved SSH candidate is preserved; no empty commit, source change or workflow rerun has been triggered by me.

Limitations retained: Codecov uploads returned HTTP429 (coverage HTML/output artifacts are present, digest-verified and inspected); CodeQL succeeds with no new changed-code alerts but scans165/271 Go files and reports deprecated v2 actions. No absent automated review is claimed passing. Full CI is not declared green while compatibility is failing. Both original production UI paths and QA acceptance for NVIDIA/NemoClaw#13090 remain pending.

[deepujain]

All eight workflows and ten current checks are now successful on 0c65a8fbe99b490739e4bc5e293db070b67f3ccb against ed8f392377849b701c13a110dad78debbb8a10f4. GitHub reports APPROVED and CLEAN; the PR remains open pending maintainer merge.

The targeted compatibility rerun, attempt 3, triggered by Pratik, passes Test_VersionCommandOutputFormat without any source change. Its log confirms the same base/head merge ref; artifacts and annotations inspected. The two authentication-dependent compatibility cases remain explicitly skipped, not counted as passes. Prior full tests, lint, vet, formatting, native build, CodeQL and release cross-build evidence remains valid. The earlier failure and diagnostic evidence are retained; no further rerun is requested.

Previously recorded Codecov upload HTTP429 and partial CodeQL/deprecation limitations remain. No absent automated review is claimed passing. This confirms CI qualification, not delivery or production QA acceptance: NVIDIA/NemoClaw#13090 still requires the corrected CLI through both reported UI paths and QA confirmation.