Upterm sharing: host key preflight + proxy session

[argusbot78]

Summary

Two improvements to ds --share (upterm backend).

1. Pre-flight uptermd host key check

Upterm is launched fully detached (</dev/null), so any SSH host-key prompt hangs forever with no way to respond. This PR adds a preflight check before detaching, while a TTY is still available.

• Uses ssh-keyscan + fingerprint comparison (handles @cert-authority trust model)
• On mismatch: shows current vs stored fingerprint, prompts [y/N] to auto-update known-hosts
• On y: strips old entries for the host:port and appends freshly scanned keys with @cert-authority prefix
• On n: aborts with a helpful hint

2. Proxy session — clients no longer mirror into your real session

Previously, --force-command attached connecting clients directly into the shared tmux session. This caused the client's terminal size to resize the session pane (smallest-client-wins in tmux).

Now a dedicated proxy tmux session (default: _share) is created at share time. Clients land there instead. They can interact with real sessions non-destructively via:

tmux capture-pane -t <session> -p      # read without attaching
tmux send-keys -t <session> "..." Enter # write keystrokes

The proxy session is created on --share and destroyed on --unshare. A bash -l fallback is included if the proxy session is killed externally.

New config option: proxy-session / DS_UPTERM_PROXY_SESSION (default: _share).

Changes

• Pre-flight host key check with interactive re-auth prompt
• @cert-authority prefix support in known-hosts auto-update
• Proxy tmux session (_share) — clients connect here instead of real session
• bash -l fallback in --force-command if proxy session is unavailable
• Proxy session cleanup in _share_stop
• README: proxy-session config option + proxy behavior documented

Testing

• Verified end-to-end: ds --share on macOS, connected via upterm, landed in _share proxy session
• Confirmed capture-pane and send-keys work against real sessions without resolution change
• Verified ds --unshare cleans up proxy session
• Reviewed known-hosts fingerprint logic for both port-22 and non-22 formats