// Package sshpush implements the v0.9 SSH-push transport layer (REQ-073,
// R-001): the CLI on the operator host SSHes to each peer to render files,
// apply configs, and run commands. It replaces the v0.8
// internal/transport mTLS HTTP layer.
//
// The Transport reuses one *ssh.Client per peer across multiple
// operations within a single CLI invocation (I-B-001), retries transient
// failures with exponential backoff (100ms ×2, cap 5s, max 5 attempts —
// reimplemented from the v0.8 transport/retry.go pattern, since
// internal/transport is deprecated and not imported), applies per-call
// timeouts (10s exec, 30s SCP per I-B-001), and fans out to many peers
// with bounded concurrency (default 8, errgroup + semaphore).
//
// Idempotency is content-addressed (C-18): WriteFile / WriteFileIdempotent
// compare the remote file's SHA-256 to the local content and skip the
// write on match — the SSH-push equivalent of the v0.8 X-Orca-Idempotency-Key.
//
// Host-key verification reuses proxmox.TOFUHostKeyCallback (D-035), which
// reads/writes the known_hosts file (certpaths.KnownHostsPath during the
// v0.9 dual-write window; the move to paths.KnownHostsPath happens in
// v0.10-P14). The known_hosts file is flock-protected inside the TOFU
// callback, so the Transport does NOT re-lock.
package sshpush