feat(cli): implement -c, -m, -s, -n and -W

[inureyes]

Part of the OpenSSH drop-in compatibility epic.

Problem

Five ssh(1) flags remain unimplemented after -E and -G are handled. Usage counts are from 1074 client invocations traced across the regression suite on 2026-08-26.

Flag	Meaning	Suite uses
-c cipher_spec	Cipher selection for the session	84
-m mac_spec	MAC algorithm selection	42
-s	Request a subsystem rather than a command	8
-n	Redirect stdin from /dev/null	8
-W host:port	Forward stdin and stdout to a host and port over the secure channel	4

-c and -m are the two largest remaining gaps after -G, and they gate the algorithm-negotiation tests (try-ciphers, integrity, kextype, keytype, limit-keytype). -W is the mechanism behind the common ProxyCommand ssh -W %h:%p bastion idiom, which README.md already shows as an example at line 1022 despite ProxyCommand not being executed at all.

Scope

• -c and -m: accept a comma-separated specification, support the +, - and ^ prefix forms OpenSSH defines for appending, removing and prioritizing, validate against what the underlying transport actually offers, and fail with the list of supported values rather than silently ignoring an unknown name. These share their resolution path with the Ciphers and MACs keywords in the keyword-wiring sub-issue and should land together.
• -s: request the named subsystem on the channel instead of executing a command. This is how sftp is invoked over ssh and is needed by match-subsystem.
• -n: redirect stdin from /dev/null. Cheap, and required for backgrounded invocations to behave.
• -W host:port: forward stdin and stdout over the channel to the named destination, implying no remote command and no tty. Pairs with the ProxyCommand sub-issue, since the two together make the standard bastion idiom work.

Acceptance criteria

• Each flag is accepted, covered by argument-parsing tests, and changes behavior.
• -c and -m support the +, - and ^ forms and reject unknown algorithm names with the supported list.
• -s opens a subsystem channel, verified against the reference sftp-server.
• -W forwards stdio to the named destination and is usable as the transport for another bssh invocation's ProxyCommand.
• The regress tests try-ciphers, integrity, kextype, keytype, limit-keytype and match-subsystem pass in the harness.

Part of #275