feat: Distribute bssh-server binary alongside bssh via import workflow

[Yaminyam]

Summary

• Extend .github/workflows/import-bssh.yml so that the automated bssh import workflow also downloads and commits bssh-server-linux-{aarch64,x86_64}-musl binaries whenever a new bssh release is cut. The existing bssh client flow is preserved; a single loop now handles both tools.
• Update src/ai/backend/agent/agent.py so the agent mounts bssh-server.{arch}.bin into session containers at /opt/kernel/bssh-server (and the manpage at /usr/local/share/man/man1/) with skip_missing=True, so that the binary becomes accessible inside sessions once the import workflow imports it without breaking existing agents that don't have it yet.

Rationale

The bssh upstream project released v2.0.x with a new bssh-server — a Rust-based SSH server for containers supporting SFTP/SCP, PTY/shell, password/pubkey auth, and audit logging. We want to make it available in session containers alongside the existing dropbear-based SSH server for stability and performance evaluation before any decision to replace dropbear is made.

As documented in recent upload-performance measurements (dogbowl, 2026-04-16), dropbear is a single-threaded SSH server that caps SFTP throughput at ~75 MB/s (CPU-bound on 1 core), while OpenSSH on the same container setup reaches ~95 MB/s. bssh-server built with russh is expected to close this gap while keeping the lightweight image footprint. Landing the binary first lets us benchmark it empirically before touching krunner's intrinsic.py.

Test plan

• Verify the import-bssh workflow run (manual dispatch) downloads both bssh and bssh-server archives for aarch64 and x86_64, extracts the binaries, and creates a PR with bssh.{arch}.bin, bssh-server.{arch}.bin under src/ai/backend/runner/.
• After the imported binaries land, confirm a new session container has /opt/kernel/bssh-server (via docker exec ... ls -la /opt/kernel/).
• Confirm dropbear still starts as the default SSH server for session containers (no behavioral regression).

Follow-ups (not in this PR)

• Wire bssh-server into src/ai/backend/kernel/intrinsic.py as an alternative (flag-driven) SSH server, once it has been manually validated.
• Decide on a migration plan from dropbear to bssh-server or OpenSSH depending on empirical measurements.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Extends the automated bssh import workflow to also vendor bssh-server release artifacts, and updates the agent’s session container mounts so the new server binary (and manpage) can be made available inside containers once imported.

Changes:

• Update .github/workflows/import-bssh.yml to download/move both bssh and bssh-server binaries for aarch64/x86_64, and to include bssh-server.1 when present.
• Update src/ai/backend/agent/agent.py to mount bssh-server.{arch}.bin into session containers at /opt/kernel/bssh-server (and bssh-server.1 into the manpage directory) with skip_missing=True.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/ai/backend/agent/agent.py	Adds mounts for bssh-server binary/manpage into session containers.
.github/workflows/import-bssh.yml	Generalizes the import workflow to fetch/commit both bssh and bssh-server artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

skip_missing=True in mount_static_binary() currently only suppresses the FileNotFoundError, but it still appends a bind mount even when the source path does not exist. For Docker/K8s agents this will still fail container startup when bssh-server.{arch}.bin is absent, which defeats the backward-compat intent mentioned in the PR description. Consider changing mount_static_binary() to return early (no mount) when skip_missing is set and resolved_path does not exist, or otherwise ensure the mount source is created as a placeholder before mounting.

Suggested change

	mount_static_binary("all-smi.1", "/usr/local/share/man/man1/all-smi.1", skip_missing=True)
	mount_static_binary(f"bssh.{arch}.bin", "/usr/local/bin/bssh")
	mount_static_binary("bssh.1", "/usr/local/share/man/man1/bssh.1", skip_missing=True)
	mount_static_binary(
	f"bssh-server.{arch}.bin", "/opt/kernel/bssh-server", skip_missing=True
	)
	mount_static_binary(
	"bssh-server.1", "/usr/local/share/man/man1/bssh-server.1", skip_missing=True
	)
	if self.resolve_krunner_filepath("runner/all-smi.1").exists():
	mount_static_binary("all-smi.1", "/usr/local/share/man/man1/all-smi.1", skip_missing=True)
	mount_static_binary(f"bssh.{arch}.bin", "/usr/local/bin/bssh")
	if self.resolve_krunner_filepath("runner/bssh.1").exists():
	mount_static_binary("bssh.1", "/usr/local/share/man/man1/bssh.1", skip_missing=True)
	if self.resolve_krunner_filepath(f"runner/bssh-server.{arch}.bin").exists():
	mount_static_binary(
	f"bssh-server.{arch}.bin", "/opt/kernel/bssh-server", skip_missing=True
	)
	if self.resolve_krunner_filepath("runner/bssh-server.1").exists():
	mount_static_binary(
	"bssh-server.1", "/usr/local/share/man/man1/bssh-server.1", skip_missing=True
	)

[Copilot]

The comment says “only bssh currently ships a manpage”, but the loop now also handles bssh-server.1. Consider updating the comment to reflect the actual behavior (e.g., move manpages if present) to avoid future confusion.

Suggested change

	# Move manpages (only bssh currently ships a manpage)
	# Move manpages if present