Add bounded passive Gateway connection inspection

[Pigbibi]

Changes

• Add a default-off passive connection inspection for the uniquely matched protected Gateway target.
• Preserve the normal metadata diagnostic path and existing per-target cloud identities.
• Inspect container state and API socket counts through one bounded SSH session over IAP, with no broker request or configuration mutation.
• Use a structured protected index, clean temporary keys on failure, and filter diagnostic authentication errors.

Validation

• Existing metadata tests and matcher tests passed.
• Passive socket, key cleanup, protected index, action log filter, and isolated workflow resolution checks passed.
• Actionlint, JavaScript and shell syntax checks, and diff checks passed.
• Independent review passed.

Runtime status

• No live connection inspection has been run from this change yet.
• Container and socket observations do not assert broker authentication, account health, or absence of pending orders.