Fix Windows SSH compatibility: ProxyCommand, key ACLs, and ESM require

[shaunymca]

Summary

• vers-client.ts, swarm.ts: remove 2>/dev/null from ProxyCommand — this Unix shell redirect is passed literally to openssl on Windows native ssh.exe (System32), breaking every SSH connection. The -quiet flag already suppresses the relevant stderr output.
• vers-client.ts, swarm.ts: replace UserKnownHostsFile=/dev/null with a platform-aware value (NUL on Windows, /dev/null elsewhere) — /dev/null works on Windows by accident via an internal OpenSSH mapping but is not guaranteed across all Windows versions.
• vers-client.ts: after writing the SSH private key file, run icacls on Windows to set correct ACLs — Node's { mode: 0o600 } is silently ignored on Windows NTFS, leaving the key accessible to SYSTEM and Administrators, causing Windows native ssh.exe to refuse it with bad permissions.
• vers-client.ts: replace require('fs').readFileSync with a proper ESM import — require() is unavailable in strict ESM and only worked due to Bun's leniency.

Test plan

• SSH connection to a Vers VM succeeds from Windows PowerShell with Windows native ssh.exe (System32)
• SSH private key is accepted without bad permissions error on Windows
• UserKnownHostsFile uses NUL on Windows and /dev/null on Unix
• No regressions on macOS/Linux

🤖 Generated with Claude Code