Keep the mnemonic out of the ssh and sftp children (closes #16)

ssh to and ssh install started the system ssh and sftp with the tool's
whole environment, so a mnemonic taken from KEYFUNC_MNEMONIC stayed in
the child's environment for as long as it ran, readable by the same user
and forwardable to the host through a SendEnv line. ssh to keeps the
private key inside the tool; the mnemonic must not leave it either.

A shared helper in the ssh cli package hands both children the tool's
environment with KEYFUNC_MNEMONIC and KEYFUNC_MNEMONIC_COMMAND removed.
The mnemonic command itself still runs with the full environment. The
stand-in ssh and sftp in the tests now record their environment, and two
tests show neither variable reaches them while another one does.

Model: opus-4-8

internal/cli/ssh/to.go

@@ -70,6 +70,7 @@ func to() *cobra.Command {
 func connect(ctx context.Context, argv []string) error {
 	//nolint:gosec // the arguments are the user's own, meant for ssh
 	command := exec.CommandContext(ctx, "ssh", argv...)
+	command.Env = childEnv()
 	command.Stdin = os.Stdin
 	command.Stdout = os.Stdout
 	command.Stderr = os.Stderr