fix: improve exec and ssh reliability

[acmore]

Summary

• retry transient container-targeted exec transport failures using the same runner policy as non-container exec
• recover from stale managed SSH control sockets before starting a new SSH master
• add regression coverage for container exec retry behavior and stale control-socket cleanup

Verification

• go test ./internal/connect ./internal/cli ./cmd/okdev
• .venv/bin/pre-commit run --all-files --hook-stage manual okdev-gofmt