[nwparker]

	Files	Added	Deleted	Net
Test	240	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​457	$\color{#cf222e}{\Huge{\mathbf{−}}}$​436	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​21
Prod	112	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​235	$\color{#cf222e}{\Huge{\mathbf{−}}}$​201	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​34

ELI5

src/main/ssh is still mostly one flat folder. This PR sorts three more groups of files into subfolders:

• the system ssh binary transport;
• the SSH config readers;
• the remote command helpers.

Nothing the app does changes.

What Changed

• Moved with git mv, names unchanged:
  • src/main/ssh/system-ssh-* (27 files) → src/main/ssh/system-transport/
  • ssh-config-*, ssh-g-config-resolution, ssh-known-hosts* and vscode-ssh-authority (18 files) → src/main/ssh/config/
  • remote-exec-*, remote-host-* and remote-frame-protocol (10 files) → src/main/ssh/remote-exec/
• References rewritten. Imports and vi.mock paths are updated in 273 importers. Most of them are the persistence tests that mock ssh-config-parser; the rest sit in ipc, wsl, managed-server, agent-hooks, github, browser, wsl-guest and tests/e2e. Path literals in reliability-gates.jsonc and ci-shard-timings.json are updated too.
• Routing. The ssh-browser-network-execution-route e2e route now names ssh/system-transport/system-ssh-dynamic-forward-process.ts. At the new path it selects the same specs as before. No other route or workflow named these files. The host-lane workflows' src/main/ssh/remote-* glob covered only the deploy primitives, which refactor(managed-server): move the managed server's install and deploy code into src/main/managed-server/install/ #30335 already moved.
• Rename-only diff. git diff -M shows every moved file as a rename. The only edits inside them are ../ import depth.

Why

This implements round 2's folder plan (§4.2, M5). It takes src/main/ssh closer to "one concept per folder". What's left at the top level is mainly the connection cluster (ssh-connection*, ssh-target*), which is M8 and needs a freeze window.

Linked Issue

N/A (SSH hardening round 2, S11/M5).

Visual Proof

N/A: a pure file move.

Testing

• typecheck:ci: clean.
• Single worker, all passing (815 files, 8,723 tests): src/main/ssh, src/main/managed-server, ipc/ssh*, src/main/wsl, agent-hooks, src/main/browser, plus every changed test file outside src/main/ssh, which includes the persistence tests with the rewritten ssh-config-parser mock.
• The path-literal, legacy-relay fence and runtime-launcher-protocol ratchets pass.
• The full local "static analysis and typecheck" job passes.
• Codex review (gpt-6.1-sol, high): clean.