fix(agent-images): retain SSH client

tests/integration/test_sandbox_escape.py

@@ -172,7 +172,7 @@ class TestSandboxEscape(unittest.TestCase):
         # base image without producing five confusing
         # command-not-found failures down the suite.
         missing: list[str] = []
-        for tool in ("curl", "git", "dig"):
+        for tool in ("curl", "git", "dig", "ssh"):
             r = cls._bottle.exec(f"command -v {tool} >/dev/null 2>&1")
             if r.returncode != 0:
                 missing.append(tool)

tests/unit/test_builtin_agent_images.py

@@ -29,6 +29,14 @@ class TestBuiltinAgentImages(unittest.TestCase):
                     re.compile(r"(?m)^\s*podman(?:\s|\\|$)"),
                 )
 
+    def test_all_install_ssh_client(self):
+        for dockerfile in _AGENT_DOCKERFILES:
+            with self.subTest(provider=dockerfile.parent.name):
+                self.assertRegex(
+                    dockerfile.read_text(),
+                    re.compile(r"(?m)^\s*openssh-client(?:\s|\\|$)"),
+                )
+
 
 if __name__ == "__main__":
     unittest.main()