test(installer): add OpenSSH distro harness

Makefile

@@ -4,17 +4,22 @@ COMMIT ?= $(shell git rev-parse --short=12 HEAD 2>/dev/null || printf unknown)
 BUILD_DATE ?= $(shell date -u +%Y-%m-%dT%H:%M:%SZ)
 LDFLAGS := -s -w -X main.version=$(VERSION) -X main.commit=$(COMMIT) -X main.buildDate=$(BUILD_DATE)
 
-.PHONY: build test check image clean
+.PHONY: build test test-ssh check image clean
 
 build:
 	mkdir -p bin
 	CGO_ENABLED=0 go build -trimpath -ldflags="$(LDFLAGS)" -o $(BINARY) ./cmd/rsmon-worker
 
 test:
-	RSMON_ENV=test CWD=$(CURDIR) go test \
+	# RSMON_TEST_DOCKER=0 pins this target to the non-Docker unit run even
+	# if a developer has the opt-in flag exported in their environment;
+	# only the explicit `make test-ssh` target starts containers.
+	RSMON_ENV=test CWD=$(CURDIR) RSMON_TEST_DOCKER=0 go test \
 		./cmd/rsmon-worker \
 		./internal/distworker \
 		./internal/installer \
+		./internal/installer/harness \
+		./internal/sshinstall \
 		./internal/webapp \
 		./internal/compose \
 		./internal/workercluster \
@@ -33,6 +38,14 @@ test:
 		./checks/cwhois \
 		./checks/llmhttp
 
+# test-ssh runs the Docker/OpenSSH source-install harness tests against
+# real Alpine, Ubuntu, and Arch fixtures. Requires a working Docker
+# daemon; the fixtures pull/start containers, so this is opt-in and is
+# never part of the default `make test` run.
+test-ssh:
+	RSMON_ENV=test CWD=$(CURDIR) RSMON_TEST_DOCKER=1 go test \
+		-v -timeout 30m -count=1 ./internal/installer/harness
+
 check:
 	go mod tidy
 	git diff --exit-code -- go.mod go.sum