SSH proxy hoop_rs fails with "unable to obtain channel" - password auth to remote servers

Bug Description

The SSH proxy (hoop_rs) consistently fails with unable to obtain channel when connecting to remote SSH servers via password authentication. The proxy establishes TCP connection and completes SSH handshake, but fails when the client sends an exec request.

Tested with gateway v1.94.0 + agent v1.94.0 - same behavior as v1.91.x.

Steps to Reproduce

1. Deploy hoop self-hosted (gateway + agent via Docker Compose)
2. Create an SSH connection to a remote server (password auth, non-standard port)
3. Run hoop connect <connection> -s -p <port>
4. In another terminal: ssh 127.0.0.1 -p <port> -o StrictHostKeyChecking=no
5. SSH connection fails immediately

Actual Behavior

Agent logs show:

1. received connect request -> sent gateway connect ok
2. starting SSH proxy connection -> establishing new SSH connection
3. closing tcp session, filter-by=<session> (DLP closes first TCP session)
4. starting SSH proxy connection (2nd attempt) -> establishing SSH connection
5. request type: exec, wantreply:true, payload-length=22
6. unable to obtain channel

Direct SSH from the agent container to the same server works perfectly with the same credentials.

Expected Behavior

SSH connection should work through the hoop proxy, as it does with direct SSH.

Environment

• Hoop version: 1.94.0 (gateway + agent)
• OS: Linux amd64 (Docker)
• Deployment: Self-hosted via Docker Compose
• SSH server: OpenSSH on non-standard port, password auth
• Reproduced on 3 different remote servers with different passwords

Relevant Log Output

{"level":"info","logger":"controller/ssh.go:75","msg":"starting SSH proxy connection at <REDACTED>"}
{"level":"info","logger":"ssh/proxy.go:79","msg":"establishing new SSH connection with server <REDACTED>"}
{"level":"info","logger":"controller/agent.go:382","msg":"closing tcp session, connid=1, filter-by=<session>:1"}
{"level":"info","logger":"controller/ssh.go:75","msg":"starting SSH proxy connection at <REDACTED>"}
{"level":"info","logger":"ssh/proxy.go:79","msg":"establishing new SSH connection with server <REDACTED>"}
{"level":"info","logger":"ssh/proxy.go:235","msg":"request type: exec, wantreply:true, payload-length=22","conn":"1","ch":1}
{"level":"warn","logger":"ssh/proxy.go:241","msg":"unable to obtain channel","conn":"1","ch":1}

Notes

• This is different from #1200 which was SSH key auth to localhost. Our case is password auth to remote servers.
• SSH key auth to localhost was fixed by #1222 (PR merged Jan 2026).
• The hoop_rs Rust SSH proxy source is not available in the open-source repo (_libhoop/proxy/ssh/ is proprietary), making community debugging difficult.
• Direct SSH from agent container works - bug is isolated to hoop_rs proxy layer.