Function resolve_ssh_dir 

pub fn resolve_ssh_dir(paths: Option<&Paths>) -> Option<PathBuf>

Resolve the SSH directory (~/.ssh) from the injected paths. Returns None when the home directory is unknown, so callers can short-circuit cleanly. Tests pass a sandboxed Paths instead of touching the real ~/.ssh.