Merge branch 'main' into claude/host-management-ui-plan-7f20ab

Seven files needed a hand. Most were two branches adding something in the same
place, but three were one branch changing what the other had moved or renamed,
and those are the ones worth reading.

The shell keeps both new fields and both constructor lines: the connection
recorder this branch built and the teams view model main did. Where main put a
teams load inside OnScreenChanged, it now sits beside the logs refresh rather
than inside RaiseSurfaceState — this branch extracted that notification block
and it is called from two properties, so a screen-specific side effect in there
would fire on every terminal switch as well.

Main gave four row types a vault id and a vault name, and this branch had moved
one of them — KnownHostRowViewModel — into its own file when the pinned keys
became a screen. Git resolved that as "deleted here, modified there" and took
the delete, which compiles as long as nobody looks: the moved copy still had
the two-argument constructor and the call site had grown to four. Carried over
by hand, along with the ordering the pins list now does on them.

The status line's quiet rule was the subtle one. Main extracted it into
IsWorthReporting; this branch had changed the same condition to read item
counts rather than raw ones, because every user action queues a log entry a
moment later and this machine reads its own entries back on the next pull. Take
main's structure and the merge builds, passes, and silently restores a bug this
branch existed partly to fix — every save's message overwritten a second after
it appears. The method now reads PulledItems and PushedItems, with the reason
in its remarks.

Two conflicts were prose that had gone stale rather than code. The keychain
screen's comment said team vaults are refused by the server's access service,
which was true when it was written and is not now; main's replacement stands,
in this branch's vocabulary. The design-gaps row for groups was claimed by both
— real host groups here, per-vault headings there — and they are different
things, so both rows stay and the difference is stated: a group is a shelf the
user chose, a vault is who can read the item.

One defect the tests found and the compiler could not. Generating a key opens
the same editor as pasting one, but not through NewKey — so it never set the
target vault main added, and a generated key was filed into whatever vault was
edited last, or none. Both key-generation tests failed on it. Fixed where the
editor opens, with the reason recorded there.

One gap is left deliberately and is written down rather than half-built. Hosts,
keys, credentials and pins are read across every vault this session holds a key
for; groups are read from the active vault alone, so a host a teammate filed
shows under UNGROUPED. Nothing is lost or misfiled — it is what the sidebar
already shows for a group that has been deleted — but closing it needs a vault
id on every group row for rename and delete, and a way to tell two vaults'
identically-named groups apart under a layout with one heading per group. Both
are worth doing and neither is a merge's business. It is in the remarks on
ReloadGroupsAsync and in docs/design-import-gaps.md.

dotnet build, dotnet test and dotnet format --verify-no-changes are all clean:
1282 tests, including the end-to-end suite against real containers.

tests/DodoSSH.Client.Ssh.Tests/RemotePathTests.cs

@@ -83,6 +83,69 @@ public sealed class RemotePathTests
             .ShouldBe("lrwxrwxrwx");
     }
 
+    [Theory]
+    [InlineData("-rwxr-xr-x", true)]
+    [InlineData("-rw-r-xr--", true)]
+    [InlineData("-rw-r--r-x", true)]
+    [InlineData("-rw-r--r--", false)]
+    [InlineData("----------", false)]
+    public void PosixMode_ReadsAnExecuteBitInAnyTriple(string mode, bool expected)
+    {
+        // Any of the three, not the owner's: the account browsing is not necessarily the owner, and a file
+        // that only the group may run is still a file somebody runs.
+        PosixMode.HasAnyExecuteBit(mode).ShouldBe(expected);
+    }
+
+    [Theory]
+    [InlineData("-rw-rw-rw-", true)]
+    [InlineData("-rw-rw-r--", false)]
+    [InlineData("-rw-r--r--", false)]
+    [InlineData("--------w-", true)]
+    public void PosixMode_ReadsTheOthersWriteBit(string mode, bool expected)
+    {
+        // The others triple only. A group-writable file is writable by a named set of people, which is what
+        // groups are for; this asks about the column that names nobody.
+        PosixMode.IsWorldWritable(mode).ShouldBe(expected);
+    }
+
+    [Theory]
+    [InlineData("")]
+    [InlineData("rwxrwxrwx")]
+    [InlineData("?")]
+    public void PosixMode_AnswersFalseForAModeItDidNotWrite(string mode)
+    {
+        // These two decide a row's colour and nothing else. A listing is not worth failing over a string of
+        // the wrong length, and an index off the end of one is how that would happen.
+        PosixMode.HasAnyExecuteBit(mode).ShouldBeFalse();
+        PosixMode.IsWorldWritable(mode).ShouldBeFalse();
+    }
+
+    [Theory]
+    [InlineData(SftpEntryKind.File, "-rwxr-xr-x", true)]
+    [InlineData(SftpEntryKind.File, "-rw-r--r--", false)]
+    [InlineData(SftpEntryKind.Directory, "drwxr-xr-x", false)]
+    [InlineData(SftpEntryKind.SymbolicLink, "lrwxrwxrwx", false)]
+    public void AnEntry_IsExecutableOnlyWhenItIsAFile(SftpEntryKind kind, string mode, bool expected)
+    {
+        // The x on a directory means "may be searched", which is true of very nearly every directory a host
+        // has. A file browser that marked them all would be marking nothing.
+        Entry(kind, mode).IsExecutable.ShouldBe(expected);
+    }
+
+    [Theory]
+    [InlineData(SftpEntryKind.File, "-rw-rw-rw-", true)]
+    [InlineData(SftpEntryKind.File, "-rw-r--r--", false)]
+    [InlineData(SftpEntryKind.SymbolicLink, "lrwxrwxrwx", false)]
+    [InlineData(SftpEntryKind.Directory, "drwxrwxrwx", false)]
+    public void AnEntry_IsWorldWritableOnlyWhenItIsAFile(SftpEntryKind kind, string mode, bool expected)
+    {
+        // The two exclusions are the point. Every symbolic link is lrwxrwxrwx and its mode governs nothing —
+        // what may be written is the target, whose mode this listing never fetched. And a world-writable
+        // directory is /tmp, made safe by a sticky bit PosixMode does not render: warning there would be
+        // warning about the half of the mode that is on screen.
+        Entry(kind, mode).IsWorldWritable.ShouldBe(expected);
+    }
+
     [Theory]
     [InlineData(0, "0 B")]
     [InlineData(1023, "1023 B")]
@@ -96,4 +159,8 @@ public sealed class RemotePathTests
         // "512.3 MB" claims a precision the figure does not have by the time it is that large.
         ByteSize.Format(bytes).ShouldBe(expected);
     }
+
+    /// <summary>An entry that is nothing but a kind and a mode, which is all these two questions read.</summary>
+    private static SftpEntry Entry(SftpEntryKind kind, string mode) =>
+        new("thing", "/tmp/thing", kind, 0, DateTimeOffset.UnixEpoch, mode);
 }