test: harden security-sensitive path coverage

[jamiesun]

Refs #13.

Summary

• add JSON contract tests for pre-connect config failures in agent mode
• reuse a JSON failure helper for blocked command short-circuit coverage
• add host-key tests for changed-key rejection and explicit insecure fallback opt-in

Coverage

• internal/app: 46.9% -> 47.2%
• internal/sshclient: 47.0% -> 49.0%

This is a focused first pass for #13, not a full closure of every candidate path listed there.

Verification

• go test ./internal/app ./internal/sshclient -run 'TestRun_BlockedCommandShortCircuits|TestRun_JSONConfigFailuresDoNotConnect|TestGetHostKeyCallbackRejectsChangedKnownHostKey|TestGetHostKeyCallbackInsecureFallbackRequiresExplicitOptIn'
• go test ./...
• go test -cover ./...
• git diff --check
• make check