v1.6.1: verify no longer flaps under repeated runs

Devbox Anywhere v1.6.1 — verify no longer flaps under repeated runs

Fixes the known issue listed in v1.6.0.

Fixed

• verify could return a false ok: false when run repeatedly (present since v1.2.0). service.ssh (and the installer's readiness probe) checks sshd with an unauthenticated ssh-keyscan 127.0.0.1 from inside the container. OpenSSH 10's default PerSourcePenalties gives each such connection a noauth penalty, so roughly 15 quick runs, such as an agent retrying verify until green, made sshd refuse loopback. service.ssh then failed until the penalty expired. The shipped sshd config now sets PerSourcePenaltyExemptList 127.0.0.1,::1. Only in-container processes connect from loopback, and remote clients arrive via the bridge, so brute-force protection for real remote sources is unchanged.

Scope

One line in stack/config/devbox-sshd.conf, which takes effect on the image rebuild your upgrade already does. No helper, installer or harness changes.

Testing

• Full canonical suite green, 52/52 named mutation reds. The new invariant test derives the loopback addresses the probes actually use from the real devbox-anywhere and install-devbox, so the exemption can't drift from the probe.
• Real-upgrade container smoke 41/41 PASS on Ubuntu 24.04 / Docker 29.1.3 / Compose v2.40.3 (v1.5.0 → this release, full v1.6.0 gate plus a new hammer step):
  • the running sshd reports the exemption
  • 25 back-to-back verify runs all returned ok: true (21 of 25 failed before the fix)
  • service.ssh still passed after 30 additional raw keyscans

Base: v1.6.0 (b01d835).