fix(gateway): make passive connection failures diagnosable

[Pigbibi]

Change

• Normalize CRLF and silently precheck the existing temporary SSH key before any connection attempt.
• Classify captured SSH/IAP errors into fixed categories; ambiguous messages remain unknown.
• Validate the six allowed passive response fields and the closed set of helper blocking reasons.
• Keep blocking responses as failures even when the SSH process exits successfully.
• Preserve protected target matching, the default-off switch, one 75-second attempt and cleanup.

Validation

• Six new diagnostic regressions, five metadata cases and the existing shell/Node checks passed.
• actionlint, Python/shell syntax, Ruff and diff checks passed.
• Independent material review passed after correcting blocked-response exit status.

No real SSH retry, broker request, VM metadata write, permission change or runtime deployment was performed. The prior connection failure remains unresolved.