ssh-client keeps ~/.ssh to what it knows: sweep every other path into a kept folder (issue 1017, ADR 0415)

ssh-client owns ~/.ssh, but treated every file it did not place as found, so a
predecessor's drop-in and old copies stayed there for weeks. Its process now
sweeps at start and every ten minutes: keys at any depth (and links to them),
authorized_keys, authorized_keys2 and sockets stay, and a folder holding one is
gone into; everything else moves to ~/.local/state/ssh-client/retired/<UTC
time>/, a folder never shared with another sweep, with a list beside it, which
ssh_client_check shows. Nothing is deleted.

modules/ssh-client/cmd/ssh-client-tools/ssh_test.go

@@ -363,6 +363,17 @@ func TestCheckFindsWhatIsWrongAndSaysWhatItDidNotCheck(t *testing.T) {
 	if got["ok"] != false || len(got["not_checked"].([]string)) == 0 {
 		t.Errorf("%v", got)
 	}
+
+	// ADR 0415 §4: the check lists what the sweep moved, and where it lies now.
+	c := client(h, f)
+	if _, err := c.Sweep(time.Date(2026, 10, 17, 12, 0, 0, 0, time.UTC)); err != nil {
+		t.Fatal(err)
+	}
+	got, _ = c.Check(context.Background(), false)
+	retired := got["retired"].([]Sweep)
+	if len(retired) != 1 || retired[0].At != "20261017T120000Z" || len(retired[0].Moved) != 2 {
+		t.Errorf("retired = %+v, want config.d/mesh and config.bak-1 in one sweep", retired)
+	}
 }
 
 func TestTheToolsServedAreTheToolsTheManifestNames(t *testing.T) {