- Replace ssh.InsecureIgnoreHostKey() with TOFU verification against
~/.ssh/known_hosts (accept-new for unknown hosts, hard reject on a
changed key) to close a MITM hole on every SFTP connection.
- Actually connect to a running ssh-agent (SSH_AUTH_SOCK) for auth
instead of only scanning default key files on disk; give a clear
error when an explicit IdentityFile is passphrase-protected.
- Fix SSHClient.walk()/DirectorySize: the internal filepathSkipDir
sentinel leaked out as a real error on stat/ReadDir failures instead
of being swallowed, aborting size calculation on the first
unreadable subdirectory instead of skipping it.
- Skip symlink-to-directory entries in remote directory copies instead
of failing the whole transfer trying to Open() them as regular files.
- Consolidate 5 duplicated sudo-aware home-dir lookups into
internal/homedir, adding a missing os.Geteuid()==0 check before
trusting SUDO_USER.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
