test: drop ssh-gate suites and shadow-route assertions (PRD 0009)

- Delete tests/unit/test_ssh_gate.py and the fixture_with_ssh helpers.
- test_pipelock_yaml: drop the ssh-leak guard (structurally
  impossible now); the remaining tests switch to fixture_minimal.
- test_pipelock_allowlist: rewrite the union/dedup test to
  exercise an egress.allowlist that duplicates a baked default
  (the property the ssh-leak assertion was hitching onto).
- test_manifest_git: shadow-route assertion becomes a legacy-ssh-
  dies-with-hint assertion, since bottle.ssh is now parse-fail.
- test_orphan_cleanup: drop the SSHGate.stop idempotency check;
  pipelock equivalent stays.
- test_dry_run_plan: drop assertions on the removed ssh_hosts /
  ssh_gate keys.

52 unit tests pass.

tests/integration/test_dry_run_plan.py

@@ -79,8 +79,6 @@ class TestDryRunPlan(unittest.TestCase):
             self.assertEqual("runc", plan["runtime"],
                              "runsc isn't available on the CI runner")
             self.assertEqual([], plan["skills"])
-            self.assertEqual([], plan["ssh_hosts"])
-            self.assertEqual([], plan["ssh_gate"])
             self.assertEqual([], plan["git_remotes"])
             self.assertEqual([], plan["git_gate"])
             self.assertEqual(False, plan["remote_control"])