* fix(ci): run only selected managed SSH specs on pull requests * fix(ci): retain full SSH coverage for routed shared helpers