fix(cli): harden crabfleet ssh fallback paths

[vincentkoc]

Summary

• harden API-to-SSH fallback so mutating commands only replay on safe pre-request/auth failures
• bound and sanitize SSH gateway, terminal, transcript, VNC, and CLI output paths
• add regression coverage for fallback, quoting, parser, resource-limit, and bounded-response behavior

Validation

• clawpatch@latest review --limit 3 --model nova-alpha --reasoning-effort high: 0 findings
• autoreview --mode branch --base origin/main: clean, patch correct 0.84
• go test ./... && go vet ./...
• pnpm check
• pnpm test
• git diff --check