[gl-agnx]

## Summary
Add a Linux NoxSSH daemon on current master, integrating the earlier server branch with current client changes.

• Ed25519 authorized_keys authentication for local OS users, persistent protected host key, Linux getrandom, six-attempt authentication limit.
• Remote exec, interactive shell, PTY, resize, stdin/stdout/stderr, exit status, four concurrent sessions, transport and idle bounds.
• --check-user account performs read-only authentication preflight without creating a host key or binding a socket. --print-host-public-key creates or reads the protected host seed and prints only the public SSH key for UART-trusted pinning.
• Fix inherited encrypted-send overflow, unsupported algorithm offers, SSH sequence handling, OpenSSH service negotiation, client OpenSSH identity parsing, and completed-child polling.
• Keep daemon opt-in and loopback-bound by default. No password, SFTP, or forwarding support.

Validation

CMake build and CTest passed in Ubuntu 24.04 VM. Windows OpenSSH authenticated with an existing authorized Ed25519 key, ran remote exec, PTY exec, interactive shell, 10,000 output lines, and propagated exit code 7. Invalid username and wrong key were rejected.

CI run 38345405100 passed Linux x86_64/ARM64 and macOS x86_64/ARM64. Linux smoke covers valid/invalid account preflight, malformed/writable key rejection, deterministic public host key reuse, OpenSSH exec, 11-second quiet child exit status, PTY shell, invalid-user rejection, and NoxSSH client interoperability.

The 04d265b server binary ran on the actual KC705 RV64 Linux system, controlled over UART and bound only to loopback 127.0.0.1:2222. Exec (id, uname), PTY, an 11-second quiet command returning 9, invalid OS user, and wrong-key rejection passed. The persistent SD host seed had root ownership and mode 0600; public fingerprint SHA256:1Cb2ywW9q2npFNJLYnYhWWgCRALJVdY5Pj1WiD33SbM. Operator cleanup status was 0. Evidence: E:/MPUNoxV_build_artifacts/ethernet_20261012/noxssh-loopback-04d265b.log.

Physical KC705 Ethernet, 2026-10-13

Yocto-pinned source1ef8774 ran on actual KC705 Linux6.18.39, both harts at200MHz, through the board RJ45 and our GMII MAC/Marvell88E1111 address7 at1000/full. Both DMA and corrected PIO configurations passed strict trusted-host Ed25519 authentication, exec/PTY, quiet11-second exit9, invalid-account/key rejection and exact262144-byte upload/download checksums. The PIO reboot automatically started NoxSSH2222 from persistent configuration and retained the same host fingerprint. Actual --check-user root succeeded. RX buffer/no-descriptor drops were recorded; no line-rate, zero-drop, physical power-cycle or clock-loss qualification is claimed.

DMA transferSHA2564a26d10d0747718f9b3d0788eeab640357c2e06d79e08747ac787662764a99b7; PIO transferSHA2569e2675e51d78132dfe1d4da1d8875dcb13e1b5534bedd8f45f176e46eb1cff85. Evidence: E:/MPUNoxV_build_artifacts/ethernet_qualification_20261013/dma-hpm-7e390d9-noxssh-physical-supplier/result.json and pio-v2-hpm-7e390d9-noxssh-persistent/result.json.

Docs now cover physical results, the512-byte exec limit, explicit sbin PATH, current public-key API/Linux PTY support and mandatory OS CSPRNG; stale password/rand/backend claims were removed. Documentation-only sourcea397eb9 does not change the tested1ef8774 binary.

Remaining integration gate

Finish monitor-enabled routed hardware, actual clock/carrier and active-DMA recovery, persistent default-port deployment and repeated boot evidence in the platform/BSP effort. Physical Ethernet authentication and transfer have passed; loopback is retained as earlier provenance.