ssh-config: make the ssh <name>.vm shortcut opt-in

Before this change, every daemon.Open() wrote a Host *.vm stanza into
~/.ssh/config in a marker-fenced block. That's a real footgun for users
who manage their SSH config declaratively (chezmoi, dotfiles, NixOS):
banger was mutating host state outside its own directory on every
daemon start, easy to miss and hard to audit.

New contract: the daemon only ever writes its own ssh_config file at
~/.config/banger/ssh_config. ~/.ssh/config is untouched unless the user
opts in. `banger vm ssh <name>` still works out of the box — the
shortcut only matters for plain `ssh sandbox.vm` from any terminal.

The opt-in surface is `banger ssh-config`:

  banger ssh-config              # prints path + include-line +
                                 # install/uninstall hints
  banger ssh-config --install    # adds `Include <bangerConfig>` to
                                 # ~/.ssh/config inside a marker-fenced
                                 # block; idempotent; migrates any
                                 # legacy inline Host *.vm block from
                                 # pre-opt-in builds
  banger ssh-config --uninstall  # removes the new Include block AND
                                 # any legacy inline block

Doctor gains a gentle warn-level note when banger's ssh_config exists
but the user hasn't wired it in — not a fail, since the shortcut is
convenience and `banger vm ssh` covers the essential case.

Tests cover: daemon writes banger file and does NOT touch ~/.ssh/config,
Install adds the block, Install is idempotent, Install migrates the
legacy inline block cleanly (removing it, preserving unrelated
entries, adding the new Include block), Uninstall removes both marker
variants, Uninstall is a no-op when ~/.ssh/config is absent, and
UserSSHIncludeInstalled detects both marker shapes.

README reframes the feature as optional convenience.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/daemon/doctor.go

@@ -3,6 +3,7 @@ package daemon
 import (
 	"context"
 	"fmt"
+	"os"
 	"runtime"
 	"strings"
 
@@ -55,11 +56,40 @@ func (d *Daemon) doctorReport(ctx context.Context, storeErr error) system.Report
 	report.AddPreflight("core vm lifecycle", d.coreVMLifecycleChecks(), "required host tools available")
 	report.AddPreflight("vsock guest agent", d.vsockChecks(), "vsock guest agent prerequisites available")
 	d.addVMDefaultsCheck(&report)
+	d.addSSHShortcutCheck(&report)
 	d.addCapabilityDoctorChecks(ctx, &report)
 
 	return report
 }
 
+// addSSHShortcutCheck surfaces a gentle warning when banger maintains
+// an ssh_config file but the user hasn't wired it into ~/.ssh/config.
+// This is intentionally a warn, not a fail — the shortcut is opt-in
+// convenience and `banger vm ssh` works either way.
+func (d *Daemon) addSSHShortcutCheck(report *system.Report) {
+	bangerConfig := BangerSSHConfigPath(d.layout)
+	if strings.TrimSpace(bangerConfig) == "" {
+		return
+	}
+	if _, err := os.Stat(bangerConfig); err != nil {
+		// No banger ssh_config rendered yet — nothing to include.
+		return
+	}
+	installed, err := UserSSHIncludeInstalled()
+	if err != nil {
+		report.AddWarn("ssh shortcut", fmt.Sprintf("could not read ~/.ssh/config: %v", err))
+		return
+	}
+	if installed {
+		report.AddPass("ssh shortcut", "enabled — `ssh <name>.vm` routes through banger")
+		return
+	}
+	report.AddWarn(
+		"ssh shortcut",
+		fmt.Sprintf("`ssh <name>.vm` not enabled (opt-in); run `banger ssh-config --install` or add `Include %s` to ~/.ssh/config", bangerConfig),
+	)
+}
+
 // addArchitectureCheck surfaces a hard-fail when banger is running on
 // a non-amd64 host. Companion binaries are pinned to amd64 in the
 // Makefile, the published kernel catalog ships only x86_64 images, and