fix(cli): bound ssh fallback output

[vincentkoc]

Summary

• sanitize unknown SSH gateway command names before echoing them to the terminal
• bound captured SSH stdout and stderr for VNC fallback paths, killing the child on overflow
• sanitize bounded SSH stderr before forwarding it to the terminal

Validation

• clawpatch@latest review --limit 3 --model nova-alpha --reasoning-effort high: 0 findings
• autoreview --mode branch --base origin/main: clean, patch correct 0.88
• go test ./... && go vet ./...
• pnpm check
• pnpm test
• git diff --check