test: cover execution result contracts

[jamiesun]

Refs #13.

Summary

• add structured JSON contract coverage for remote non-zero exits and command timeouts
• extend stdout capture helper so JSON result tests can share one path
• add an in-process SSH server test proving sudo commands are rewritten to the stdin password path and the fake password is not echoed in captured output

Coverage

• internal/sshclient: 49.0% -> 49.9%
• internal/app remains 47.2% by statement coverage, with stronger JSON contract assertions

This continues #13 after #21. It still references the issue instead of closing it because settings failure paths and broader audit event contracts can be covered in a follow-up.

Verification

• go test ./internal/app ./internal/sshclient -run 'TestEmitCommandJSONContracts|TestRunCommandSudoFeedsPasswordOnStdin|TestRunCommandTimeout|TestRunCommandNonZeroExit'
• go test ./...
• go test -cover ./...
• git diff --check
• make check