test(installer): add OpenSSH distro harness

docs/changelog.md

@@ -2,6 +2,42 @@
 
 ## 2026-08-12
 
+### Source-install harness and planning foundations (work packages 1-2)
+
+- Added `internal/installer/harness`: a reusable Docker/OpenSSH test harness
+  that builds real OpenSSH containers for Alpine, Ubuntu, and Arch, waits for
+  real network SSH readiness, captures the server host key into a temp
+  `known_hosts` file, and tears the container, network, per-instance fixture
+  image tag, and temp dir down reliably. It uses the `golang.org/x/crypto/ssh`
+  library and known_hosts verification semantics the installer's `deploy` path
+  relies on (the harness owns its connection code rather than reusing the
+  installer functions) and never mocks SSH. A fresh known_hosts file trusts
+  the first key (TOFU); the host-key mismatch test proves a different key is
+  rejected before any command runs.
+- Added distro fixtures under `internal/installer/harness/testdata/fixtures`.
+  Alpine defaults to the `reg.rsxx.ru/library/alpine:3` mirror; Ubuntu and Arch
+  fall back to Docker Hub refs overridable via `RSMON_TEST_IMAGE_<NAME>`.
+  Each fixture starts clean (no Go, no worker source) and authenticates with a
+  bundled test key; password auth is disabled. The test key is strictly
+  test-only - it grants root only to the disposable fixture containers - and
+  must never be used outside the harness.
+- Added opt-in integration controls: the Docker tests run only with
+  `RSMON_TEST_DOCKER=1` (`make test-ssh`); default `make test` and `go test
+  ./...` skip them and never pull or start containers. `make test` also pins
+  `RSMON_TEST_DOCKER=0` so an exported opt-in flag cannot leak into the unit
+  run.
+- Integration tests assert real SSH round trips, clean target state, distro /
+  package-manager / init detection per fixture, a full source plan including
+  the pinned Go toolchain, host-key mismatch rejection, host-key stability,
+  failed-start cleanup, and complete teardown (container, network, fixture
+  image tag, and temp dir gone).
+- Added `internal/sshinstall`: pure, unit-tested detection and planning for the
+  source installer - os-release parsing, distro/package-manager/init
+  resolution, `uname -m` to Go archive mapping, pinned Go 1.26 toolchain with
+  published SHA-256, and a reviewable ordered plan. No remote execution yet.
+- `make test` now includes the new packages; `make test-ssh` runs the live
+  fixture matrix.
+
 ### Public endpoint configuration (milestone 1 of public-endpoint-and-identity)
 
 - `PUBLIC_URL` is now the canonical advertised public origin; the legacy