fix(pi-ssh): harden remote execution and search

pi-ssh/test/config-and-import.test.ts

@@ -1,5 +1,6 @@
 import assert from "node:assert/strict";
 import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
 import test from "node:test";
 import { validatePiSshConfig } from "../src/config.ts";
 import { effectiveValue, effectiveValues, parseSshG } from "../src/import.ts";
@@ -61,3 +62,10 @@ test("formats SSH host keys as pinned SHA256 fingerprints", () => {
     fingerprint: `SHA256:${expected}`,
   });
 });
+
+test("configuration import validates remote HOME and cwd with framed probes", async () => {
+  const source = await readFile(new URL("../scripts/ssh-config.mjs", import.meta.url), "utf8");
+  assert.match(source, /probeRemotePath\(transport, "home"\)/);
+  assert.match(source, /probeRemotePath\(transport, "cwd"\)/);
+  assert.doesNotMatch(source, /transport\.capture\(/);
+});