fix(ssh): recover Brev includes scoped to unrelated hosts

[deepujain]

When the Brev SSH Include is inside an unrelated Host or Match stanza, brev refresh currently finds its text and leaves the alias unresolved. Only an Include in global scope now counts as installed, so the existing insertion path prepends a global Include. The existing configuration is preserved, and subsequent refreshes do not rewrite it again. Unix and Windows path matching remain supported.

Related to NVIDIA/NemoClaw#13090 and its QA reproduction. This does not establish who originally misplaced the workstation Include.

Validation dependency: #508 repairs the base's disallowed CI notification action and stale assertions after merged #484. Full qualification requires that dependency and maintainer approval of fork workflows.

Validation:

• Focused regressions pass with the race detector, including actual OpenSSH ssh -F ... -G routing recovery, unrelated settings, Unix/WSL idempotence, and certificate-template coverage. New regressions fail against unchanged base a0190d24655f57f327778f7708d8a6f634afdb1a.
• Refresh, shell, mint-cert and sshcert package tests pass with the race detector.
• gofumpt and git diff checks pass.
• The full local SSH package run hits the same pre-existing macOS JetBrains path failure/nil dereference on both base and candidate. Hosted Linux CI remains required; this is not a waiver.

The retained QA workstation still needs the corrected CLI tested through both original Setup over SSH and Coding Agent paths, refresh/reconnect, onboarding and a real agent response. This PR does not claim production acceptance or publish a CLI release.

[deepujain]

Full qualification is currently blocked by existing main-branch CI failures. Linked prerequisite: #508 fixes the enterprise-disallowed notification action in the test workflow and stale HTTPResponseError assertions after merged #484. The SSH repair remains scoped to its two files.

GitHub has held the fork workflows for maintainer approval. A maintainer with Actions write authority needs to approve the runs on #508 and this PR. My account has read-only upstream access, so it cannot approve those runs or the code-owner review. No unchanged workflow reruns or new repair pushes have been triggered.

Published SSH candidate: ed93a09581f098b429018371ae5f33a7614cc7e8; base: a0190d24655f57f327778f7708d8a6f634afdb1a. GitHub verifies its signature. Focused race regressions, actual OpenSSH routing/preservation test, impacted package tests, package lint (zero findings), package vet, formatting and native build pass. Full upstream Linux CI and production QA acceptance remain pending; local results do not waive them.