refactor(hub): make SSHTransport the single owner of each system's SSH connection

The updater and on-demand requests kept separate copies of the SSH client
(sys.client and the transport's client) and synced them after each request.
That allowed a closed client to be reinstalled over a newer one and leaked
connections that were replaced without being closed.

The updater now dials, opens sessions and tears down timed-out connections
through the transport. The dial keeps the TCP keepalive and handshake
deadline, and an OnConnect callback handles the per-connection resets.
The transport is created under a lock and agentVersion is now atomic.

internal/hub/systems/network_monitor_sync_test.go

@@ -62,7 +62,8 @@ func TestNetworkMonitorSyncSkipsOlderAgents(t *testing.T) {
 	for _, version := range []string{"0.0.0", "0.18.0", "0.19.0"} {
 		t.Run(version, func(t *testing.T) {
 			// No transport: attempting to send any request would fail.
-			sys := &System{agentVersion: semver.MustParse(version)}
+			sys := &System{}
+			sys.setAgentVersion(semver.MustParse(version))
 			require.NoError(t, sys.SyncNetworkMonitors(nil))
 			result, err := sys.UpsertNetworkMonitor(monitor.Config{ID: "test"}, true)
 			require.NoError(t, err)