Add SSH proxy authorization probe

AGENTS.md

@@ -164,6 +164,10 @@ Roadmap items should be actionable and checkable:
   `geth pipe connect <name> --node <node-id>` uses the protected Iroh control
   ALPN and requires `pipe.connect` on `resource:pipe:<name>`. Iroh byte streams,
   TCP/Unix forwarding, and remote listener creation are still roadmap work.
+- `geth ssh proxy <node-id>` performs an authorized control-plane handshake over
+  the protected Iroh control ALPN and requires `ssh_proxy.connect` on
+  `resource:ssh-proxy:local` before returning proxy metadata. It does not carry
+  SSH bytes or connect to sshd/admin shell yet.
 - Resource secret epoch metadata can be created, rotated, and listed locally.
   Bearer access metadata can be created/listed/revoked as resource-scoped auth
   ops and must not allow trust graph mutation capabilities. Payload encryption,