test: harden SSH interoperability and lifecycle regressions

[skevetter]

Summary

Implements the hardening plan tracked in #30 as a single PR with multiple logical commits.

This branch builds on v1.2.7 and focuses on regression prevention rather than rewriting the SSH library.

Included so far

• clarify peer-activity/keepalive semantics without changing v1.2.7 behavior
• add a real OpenSSH ssh -N -D interoperability test that:
  • survives multiple keepalive deadline windows
  • opens 10 sequential direct-tcpip channels over one parent connection
  • idles again and verifies forwarding still works
• add direct concurrent coverage for openChannelSet
• add GitHub Actions jobs for:
  • OpenSSH integration tests
  • go test -race ./...
• add .gitlab-ci.yml so GitLab Runner executes:
  • unit tests
  • race tests
  • the same OpenSSH integration suite

Validation commands

go test ./...
go test -race ./...
go test -count=1 -tags=openssh_integration ./...

Remaining work in this PR

• expand channel-close/keepalive race coverage
• add callback cardinality and shutdown lifecycle coverage
• update lifecycle/keepalive documentation
• address any CI findings from the new integration/race jobs

Notes

Commit-signing CI is intentionally not being addressed in this PR; signing will be handled separately before merge.

Closes #30 when the full checklist is complete.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign those commits (git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}) and force push them to this branch (git push --force-with-lease).

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.

Learn how to use 1Password to sign your commits.