feat(ssh): discover computers from ~/.ssh/known_hosts + remote system-prompt

Two improvements to the SSH support feature:

1. KNOWN_HOSTS DISCOVERY (packages/ssh):
   Computers are now auto-discovered from ~/.ssh/known_hosts (every hostname
   you've ever connected to) in ADDITION to ~/.ssh/config (explicit Host
   aliases). Config entries take precedence (full params); known_hosts entries
   get defaulted params (User=defaultUser, IdentityFile=null→pool probes
   default keys, Port from [host]:port or 22, knownHost=true). Zero-config —
   no ~/.ssh/config file needed; hosts just appear.

   Reject list: dispatch.toml [ssh].reject = [...] (glob patterns like
   github.com, *.ts.net) filters noise from the catalog. Read from both
   the global ~/.config/dispatch/dispatch.toml and the project dispatch.toml.
   Parsed with Bun.TOML.parse (zero deps). Only filters discovery (catalog);
   specific lookups (getComputer/getStatus/test/connect) ignore the reject
   list (it's a visibility filter, not access control).

   New pure functions: parseKnownHosts(), isRejected(), globMatch().
   +26 tests. tsc EXIT 0, biome clean, 1756 tests pass.

2. REMOTE SYSTEM-PROMPT AWARENESS (packages/system-prompt):
   When a conversation has a computerId set (remote turn), the system prompt
   now resolves system:os, system:hostname, git:branch/git:status, and
   file: reads against the REMOTE machine — not the local host. Previously
   the prompt always said 'Arch Linux (WSL)' + local hostname even when the
   agent was connected to a remote Artix Linux machine.

   The ResolverAdapters' hostname()/platform() are now async (so a remote
   adapter can run 'hostname'/'uname -s' over SSH). The system-prompt
   extension builds remote adapters from the ExecBackend (readFile→SFTP,
   spawn→SSH exec). Cache invalidation now checks computerId (switching
   computers rebuilds the prompt). The compaction path also threads
   computerId. @dispatch/system-prompt now depends on @dispatch/exec-backend.

1 files changed, 18 insertions, 8 deletions

diff --git a/packages/system-prompt/src/types.ts b/packages/system-prompt/src/types.ts
index 4e1db0b..a9fe3ca 100644
--- a/packages/system-prompt/src/types.ts
+++ b/packages/system-prompt/src/types.ts
@@ -20,25 +20,35 @@ export interface SystemPromptService {
 	 * result under `resolved:<conversationId>`. Returns the resolved string.
 	 * When no template is stored, the built-in default template is used. An
 	 * empty template yields an empty string.
+	 *
+	 * When `context.computerId` is set, the resolver uses remote-backed adapters
+	 * (reading the remote's `/etc/os-release`, `hostname`, `uname`, `git` via
+	 * the ExecBackend/SSH) so the system prompt reflects the REMOTE machine.
 	 */
 	construct(
 		conversationId: string,
 		cwd: string,
-		context?: { readonly model?: string; readonly workspaceId?: string },
+		context?: {
+			readonly model?: string;
+			readonly workspaceId?: string;
+			readonly computerId?: string;
+		},
 	): Promise<string>;
 
 	/** Read the persisted resolved system prompt, or `null` if never constructed. */
 	get(conversationId: string): Promise<string | null>;
 
 	/**
-	 * Read the persisted resolved system prompt AND the cwd it was built
-	 * against. Returns `{ prompt: null, cwd: null }` if never constructed.
-	 * Consumers use this to detect whether the cached prompt is stale
-	 * relative to the current effective cwd.
+	 * Read the persisted resolved system prompt AND the cwd + computerId it was
+	 * built against. Returns `{ prompt: null, cwd: null, computerId: null }` if
+	 * never constructed. Consumers use this to detect whether the cached prompt
+	 * is stale relative to the current effective cwd or computerId.
 	 */
-	getWithMeta(
-		conversationId: string,
-	): Promise<{ readonly prompt: string | null; readonly cwd: string | null }>;
+	getWithMeta(conversationId: string): Promise<{
+		readonly prompt: string | null;
+		readonly cwd: string | null;
+		readonly computerId: string | null;
+	}>;
 
 	/** Read the global template (or `DEFAULT_TEMPLATE` when none is stored). */
 	getTemplate(): Promise<string>;