feat(runner): support SSH repository clone

[pentaxis93]

Summary

• Adds SSH repository URL support for runner-managed clone setup.
• Uses agent-scoped mounted OpenSSH material by running SSH clone as the session user with the session home.
• Adds real Podman coverage proving SSH clone succeeds with the owning agent identity and fails without that mounted identity.

Changes

• Accepts ssh:// and user@host:path SSH repository URLs while continuing to reject credential-bearing URLs.
• Keeps repo_token HTTPS-only and leaves the existing HTTPS clone path unchanged.
• Extends dispatch, unit, and session lifecycle tests, including a real SSH git server fixture.
• Documents SSH clone requirements and records the change in the changelog.

GitHub Issue(s)

Closes #139

Test plan

• cargo fmt --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --workspace