hub: wgsync fix — constrain HostKeyAlgorithms to the pinned key's type

Live S1 validation caught it: a stock multi-hostkey sshd presented ECDSA while
we pin ed25519 → FixedHostKey refused a legitimate server. Regression test with
an in-process dual-hostkey server (fails without the fix — red-proofed).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

hub/internal/wgsync/client.go

@@ -79,7 +79,13 @@ func (c *Client) Push(ctx context.Context, payload []byte) error {
 		User:            c.user,
 		Auth:            []ssh.AuthMethod{ssh.PublicKeys(c.signer)},
 		HostKeyCallback: ssh.FixedHostKey(c.hostKey),
-		Timeout:         c.timeout,
+		// Constrain negotiation to the PINNED key's algorithm. Without this the default
+		// algorithm preference makes a multi-hostkey sshd (stock: ECDSA + ed25519) present a
+		// different key type than the pinned one — FixedHostKey then refuses a LEGITIMATE
+		// server. Found live in the S1 validation (host key mismatch against the real sshd);
+		// regression: TestPush_MultiHostkeyServerStillMatchesPin.
+		HostKeyAlgorithms: []string{c.hostKey.Type()},
+		Timeout:           c.timeout,
 	}
 	dialer := net.Dialer{Timeout: c.timeout}
 	conn, err := dialer.DialContext(ctx, "tcp", c.addr)