test: expand sanitized sshd and PAM corpus for parser and report regression

[stacknil]

Closes #21

Summary

• expand the checked-in sanitized sshd and PAM corpus used by parser and report regression tests
• strengthen single-host and multi-host regression coverage without changing parser/detector policy
• preserve deterministic parser coverage metrics and existing golden report contracts

Scope

This PR is limited to corpus and regression coverage.
It does not change detector thresholds, add new output formats, introduce enrichment, or add cross-host correlation.

What changed

• added more sanitized sshd success / failure / disconnect / edge-case fixtures
• added more selected PAM-family fixtures across explicitly recognized and telemetry-only variants
• strengthened at least one multi-host regression case
• updated regression tests so parser coverage and golden report contracts remain deterministic

Verification

• cmake --preset dev-debug
• cmake --build --preset dev-debug
• ctest --preset dev-debug
• cmake --preset ci-release
• cmake --build --preset ci-release
• ctest --preset ci-release