internal/sshd (new): a golang.org/x/crypto/ssh listener that parses the
client's command string (git-upload-pack / git-receive-pack only), maps
configured public keys to principals (write/admin flags), and dispatches
to a Transport the server implements — the same git pipeline HTTP uses.
No PTY/shell/subsystem; option-bearing argv refused; GIT_PROTOCOL v2
passthrough for fetch; host key from config or auto-generated ed25519
under <data-dir>/ssh/.

The framing traps this design answers (17_ssh.md §2):
- stateless-rpc waits for stdin EOF, which never comes over SSH — fetch
  runs upload-pack interactively (UploadPackSSH).
- receive-pack OPENS with the server's ref advertisement; without it both
  sides hang.
- git send-pack never closes its side before the report — the pack is
  parsed incrementally (ParsePushRequestStream) and streamed through
  IngestStream (index-pack stops at the pack trailer; the feed goroutine
  is released at child exit, not awaited). Pure-delete pushes send no
  pack at all and skip ingest.

Gates (drain, placement, max_push_bytes) apply to SSH exactly as HTTP.
Config: [server.ssh] listen/host_key/host_key_env + [[server.ssh.keys]]
(principal/key/key_env/write/admin), validation fail-closed. Law 1
amended for golang.org/x/crypto (explicit user request, issue #1).

Tests: sshd command/auth/dispatch over real loopback handshakes, the
session-limiter, PTY refusal, GIT_PROTOCOL passthrough; server gates;
real git clone+push over ssh:// against the in-process server (both
directions); IngestStream/ParsePushRequestStream/UploadPackSSH at the
git layer. Coverage floors hold for every package.

@@ -61,1 +61,4 @@
 | `server.tls.cert/key/hostnames` | — | files-mode PEM; self-signed SANs (default localhost, *.localhost, 127.0.0.1, ::1 + public_url host) |
+| `server.ssh.listen` | `""` | SSH git transport bind address; empty = disabled (17_ssh.md) |
+| `server.ssh.host_key` / `host_key_env` | — | OpenSSH/PEM private key: path / env var NAME; auto-generated ed25519 under `<data-dir>/ssh/` when unset |
+| `server.ssh.keys[]` | — | `{principal, key \| key_env, write, admin}`; public keys allowed to clone/fetch (and push with `write`) over SSH |

@@ -0,0 +54,4 @@
+listen = ""            # e.g. "0.0.0.0:2222"; empty = disabled (default)
+host_key = ""          # path to an OpenSSH/PEM private key
+host_key_env = ""      # env var NAME holding the private key; overrides host_key
+[[server.ssh.keys]]

@@ -0,0 +36,4 @@
+// one GET of latency per lookup and per list entry (see E1 in the evidence doc).
+func TestSSHKeyRegistryScale(t *testing.T) {
+	if os.Getenv("WALHUB_EVIDENCE") != "1" {
+		t.Skip("set WALHUB_EVIDENCE=1 to run the evidence benchmark (~40s, ~2GB RAM)")

@@ -57,0 +112,4 @@
+
+func newCapReader(r io.Reader, max int64) *capReader { return &capReader{r: r, max: max} }
+
+func (c *capReader) over() error {

@@ -0,0 +127,4 @@
+	if perr != nil {
+		return fmt.Errorf("malformed push request: %w", perr)
+	}
+	remaining := int64(s.cfg.Server.MaxPushBytes) - lr.n

@@ -0,0 +258,4 @@
+		return
+	}
+	s.mu.Lock()
+	if s.live[sconn]++; s.live[sconn] > maxSessionsPerConn {

@@ -0,0 +94,4 @@
+		switch {
+		case errors.Is(err, ErrKeyDuplicate):
+			writePlain(w, http.StatusConflict, err.Error())
+		case errors.Is(err, ErrKeyBadKeyLine), errors.Is(err, ErrKeyBadPrincipal):

@@ -0,0 +275,4 @@
+	// Finish one session, then the same connection must admit a new one: the
+	// refused attempt above must not have leaked its increment.
+	tr.releaseOne()
+	time.Sleep(50 * time.Millisecond) // let the server observe the exit