SSH origin checks cover auth contracts and once-schedule create/delete when external HTTPS is blocked; includes install script for probe credentials. Co-authored-by: Cursor <cursoragent@cursor.com>