fix: inspect remaining gateways through protected identity

[Pigbibi]

Scope

Extend the existing protected remaining-target diagnostic to passive connection inspection. Keep the default metadata mode and completed target unchanged.

Changes

• Derive the three remaining indices from protected inventory and validate their existing SSH configuration.
• Require exact VM resource identity before reading the existing SSH key or opening one bounded IAP session.
• Preserve per-target authentication, masking, cleanup and single-attempt behavior.
• Reject remaining-target SSH policy and key-binding combinations. No broker calls or permission changes.

Validation

Author: resolver, passive shell, metadata shell, shared workflow config, seven SSH diagnostic tests, actionlint, shell syntax and diff checks passed.
Root: resolver, metadata shell, passive shell, seven SSH diagnostics, actionlint and diff checks passed. Independent material review passed for this scope.

Actual per-target Secret/IAP access and passive socket observations remain to be verified. These observations do not prove broker authentication or business recovery.