feat(cli): implement -c, -m, -s, -n and -W

[inureyes]

Summary

• implement OpenSSH-compatible -c and -m selection, including +, -, and ^ modifiers, last-value precedence, and supported-value diagnostics
• implement subsystem (-s) and null-stdin (-n) session policies
• implement byte-transparent, full-duplex -W host:port stdio forwarding, including bracketed IPv6 and TCP service names
• make -W usable as a nested bssh ProxyCommand transport while preserving OpenSSH forwarding defaults and explicit overrides
• promote match-subsystem into the runnable pinned OpenSSH regression selection

Validation

• cargo fmt --all -- --check
• cargo check --locked
• cargo clippy --locked -- -D warnings
• cargo test --locked --lib (1,658 passed, 7 ignored)
• cargo test --locked --test ssh_compat_output_test (14 passed)
• cargo test --locked --test ssh_config_dump_test (21 passed)
• cargo test --locked --test forwarding_live_test (9 passed)
• python3 -m unittest tests/openssh-regress/test_run.py (13 passed)
• pinned OpenSSH regress: try-ciphers, integrity, kextype, keytype, limit-keytype, and match-subsystem (6/6 passed)
• pinned OpenSSH exit-status and transfer coverage for -n (2/2 passed)
• reference sftp-server subsystem version handshake passed

Closes #285