core/tools: announce a remote shell instead of judging it

`ssh prod` runs no command this scan can resolve, and what is typed or piped
into the shell it opens never reaches any gate — `write_pty` and
`run_argv(stdin=…)` are both unchecked input. The tool description said nothing
about it, so the call looked like any other.

The hop is now reported even when no command follows
(`RemoteTarget.shell`), and the review announces it: `remote shell on 'prod'
(ssh with no command; its input is not checked)`. It is a soft confirm like the
other reviews (YOLO may skip it, an escalation behind a hop still may not) — the
client itself stays outside the denylist, since there is no program to name.

tests/test_tools/test_command_scan.py

@@ -171,11 +171,16 @@ def test_unwrap_remote_batch_mode() -> None:
 
 def test_unwrap_remote_client_alone() -> None:
     """A client with no command opens a remote shell: nothing to unwrap."""
-    for argv in (["ssh", "prod"], ["ssh", "-N", "prod"], ["ssh", "-G", "prod"], ["ssh"], ["mosh", "prod"]):
+    for argv in (["ssh", "prod"], ["ssh", "-N", "prod"], ["ssh", "-G", "prod"], ["mosh", "prod"]):
         scan = unwrap_command(argv)
         assert scan.wrappers == (), argv
         assert scan.base == argv[0], argv
-        assert scan.remote is None, argv
+        assert scan.remote is not None, argv
+        assert scan.remote.shell is True, argv
+        assert scan.remote.host == "prod", argv
+    # Without a destination there is no hop to announce.
+    for argv in (["ssh"], ["ssh", "-V"]):
+        assert unwrap_command(argv).remote is None, argv
 
 
 def test_unwrap_remote_command_still_reviews_what_runs() -> None:

tests/test_tools/test_danger.py

@@ -174,6 +174,20 @@ def test_a_remote_command_is_judged_by_what_runs_there() -> None:
     assert pty is not None and "python3" in pty
 
 
+def test_a_remote_shell_is_announced() -> None:
+    """``ssh host`` runs nothing this scan can see, so the human is told first."""
+    reason = _reason("open_pty", {"command": ["ssh", "prod"]})
+    assert reason is not None
+    assert "remote shell on 'prod'" in reason
+    assert "input is not checked" in reason
+    # The same for a one-shot client: stdin is another unchecked input channel.
+    assert "remote shell on 'prod'" in (_reason("run_argv", {"argv": ["ssh", "-p", "2222", "prod"]}) or "")
+    # A mosh shell counts too, and a hop with nothing after it is not silent.
+    assert "remote shell" in (_reason("open_pty", {"command": ["mosh", "prod"]}) or "")
+    # A remote *command* keeps its own review (no shell wording).
+    assert "remote shell" not in (_reason("run_argv", {"argv": ["ssh", "prod", "uptime"]}) or "")
+
+
 def test_batch_mode_is_always_reviewed() -> None:
     """``BatchMode=yes`` cannot prompt at either end, so the command is shown."""
     reason = _reason("run_argv", {"argv": ["ssh", "-o", "BatchMode=yes", "prod", "deploy.sh"]})