Function classify_ssh_error 

pub fn classify_ssh_error(stderr: &str) -> SshDiagnosis

Classify stderr from a failed ssh invocation. Substring match, most specific first: HostKeyChanged and ConnectionRefused are checked before the more generic Unreachable/PermissionDenied, and PermissionDenied’s “Permission denied”/“publickey” are checked before falling back to Other.