fix(ssh): pass the socket path to awk without escape expansion

awk expands escape sequences in a -v value, so reset's /proc/net/unix comparison
never matched a socket path holding a backslash — a live owner under a $HOME like
/home/alice\\backup read as absent, and reset reported a stop it had not made.
ENVIRON carries the bytes through untouched.

Verified in a Debian container with that exact home: the live owner is now
reported as surviving, and the ordinary matrix is unchanged.

src/main/ssh/ssh-relay-reset.test.ts

@@ -212,6 +212,12 @@ describe('forceStopRelayForTarget', () => {
     expect(command).toContain('lsof -t -a -U "$1"')
     expect(command).toContain('pgrep -f "$sock_name"')
     expect(command).toContain('/proc/net/unix')
+    // Why ENVIRON: awk expands escape sequences in a -v value, so a socket path holding a
+    // backslash would never equal its own /proc/net/unix entry and a live owner would read
+    // as absent. (The branch itself needs /proc, so it is exercised on Linux.)
+    expect(command).toContain('ORCA_SOCKET_TARGET="$1" awk')
+    expect(command).toContain('ENVIRON["ORCA_SOCKET_TARGET"]')
+    expect(command).not.toContain('awk -v target')
     // Why not: a stopped relay unlinks its own socket, and one that was killed leaves an
     // inode the next deploy releases under its identity guard (STA-1756).
     expect(command).not.toContain('rm -f')

src/main/ssh/ssh-relay-reset.ts

@@ -51,9 +51,12 @@ export async function forceStopRelayForTarget(
     // fail on a legal path. Why the exit-code split: a missing or failing tool answers
     // nothing, and reading that as "no owner" is the inference this change removes.
     '  if [ -r /proc/net/unix ] && command -v awk >/dev/null 2>&1; then',
-    '    awk -v target="$1" \'NR>1{line=$0;' +
+    // Why ENVIRON rather than -v: awk expands escape sequences in a -v value, so a path
+    // holding a backslash would never equal its own /proc/net/unix entry.
+    '    ORCA_SOCKET_TARGET="$1" awk \'NR>1{line=$0;' +
       'sub(/^[^ ]+ +[^ ]+ +[^ ]+ +[^ ]+ +[^ ]+ +[^ ]+ +[^ ]+ +/,"",line);' +
-      "if(line==target){found=1}}END{exit(found?0:1)}' /proc/net/unix",
+      'if(line==ENVIRON["ORCA_SOCKET_TARGET"]){found=1}}' +
+      "END{exit(found?0:1)}' /proc/net/unix",
     '    case $? in 0) return 0 ;; 1) return 1 ;; *) return 2 ;; esac',
     '  fi',
     '  if command -v lsof >/dev/null 2>&1 && [ -n "$(lsof -t -p $$ 2>/dev/null)" ]; then',