…ce/liveness (#576)

Follow-up to PR #575 (auth-method learning). The same three paths that
talk to a managed host still probed sudo mode from scratch every cycle —
running a doomed `sudo -n` on a password-sudo host before retrying
`sudo -S`. Extend the connprofile memo to the SUDO dimension so each path
leads with the host's recorded mode and records the mode confirmed to
work.

Division of labour:
- The liveness privilege probe is the AUTHORITATIVE sudo-mode learner: it
  runs an innocuous `true` sentinel every ~5 min, so it reliably confirms
  the mode regardless of any real command's exit code.
- OS discovery (firewall probe) and OS intelligence (collector) learn
  OPPORTUNISTICALLY from their existing real sudo commands — no extra
  round-trip. To avoid misrecording, a mode is recorded ONLY on a
  confirmed exit-0 of a given sudo form, never inferred from a command
  that failed for its own reasons.

Mechanics:
- ssh.RunSudo (collector's shared primitive) gains a prefer (in) + observed
  (out): when prefer=SudoPassword and the password gate is satisfied it
  leads with `sudo -S`, skipping the doomed `sudo -n`; observed reports the
  confirmed form. Plain-string tokens (SudoNopasswd/SudoPassword) keep the
  ssh package decoupled from connprofile, matching PreferKey/PreferPassword.
- discovery.runSudoWithFallback + probeFirewall thread prefer + return the
  learned mode; the discovery Service reads it (cfg.prefer) and records it.
- sshprivilege.Probe extracts probeSudo: leads with `sudo -S` on a known
  password host, records the confirmed mode (preserving the AC-18/19/21
  error shapes).
- collector threads the recorded mode across the cycle's sudo commands and
  records once at the end.
- cmd/openwatch wires the shared connprofile store into the collector and
  discovery services (the probe already had it from #575).

The sudo password GATE (kill-switch + auth-method) is unchanged: leading
with `sudo -S` is allowed only when a password may already be fed. Learning
stays best-effort — a store miss/error escalates in the default order and
never fails the connection; a stale mode self-heals (sudo -S miss falls
back to sudo -n).

Spec system-connection-profile -> v1.2.0: C-07, AC-10 (RunSudo primitive),
AC-11 (discovery firewall probe), AC-12 (liveness probe).

Closes the project's biggest test blind spot: the dial, auth-ordering,
and sudo -n/-S paths were only unit-tested at the command-construction
level (stubbed transport), never against a real box. A wired-up host
could regress and every test stay green.

internal/ssh/livehost_test.go drives the REAL ssh.Dial + ssh.RunSudo —
the primitives every host-talking path (scan, discovery, collector,
liveness) shares — against an operator-supplied inventory:

  OPENWATCH_LIVE_HOSTS=/path/to/test_hosts.csv  (hostname,ip,username,credential)
  OPENWATCH_LIVE_KEY=/path/to/id_rsa

With either unset the test t.Skip()s, so it never gates normal CI; the
inventory + key stay on the operator's workstation, never in the repo.

The fleet is heterogeneous, so the test DISCOVERS each host's
capabilities rather than demanding every method everywhere. Per host it
asserts the machinery for whatever the host supports:

  - key auth dials      -> ObservedAuth == "key"      (the value the memo records)
  - password auth dials -> ObservedAuth == "password"
  - sudo mode confirmed via the `true` sentinel (nopasswd | password)
  - the real `sudo -S -k -p '' true` password-on-stdin path executes

A server-side auth rejection (key not authorized, or PasswordAuthentication
off) is a tolerated host-config fact; an unreachable host is skipped; only
an unexpected protocol-level error or a wrong ObservedAuth/sudo result
fails the test. A host with no usable auth is skipped.

Validated against the dev fleet: 5 key+NOPASSWD hosts pass (real key dial,
sudo -n, and sudo -S all exercised), key-rejecting and unreachable hosts
skip. The password-AUTH assertion is live-unverified only because the dev
fleet runs PasswordAuthentication=no everywhere (noted in BACKLOG); it
runs as soon as one password-enabled host is in the inventory.

Also drops the completed "wire SSH auth/sudo learning" backlog entry
(shipped in #575 + #576).