Apply the same convergence to the serverless-GPU acceptance test (follow-up to
#5878, where the review asked to fold the two test styles into one acceptance
test). Locally it now runs a single `ssh connect --proxy` that submits the same
serverless-GPU bootstrap job and pipes stdin/stdout over the driver-proxy
websocket echo route, asserting both the job payload and the echoed bytes.

## Changes

The dedicated-cluster counterpart to
`acceptance/ssh/connect-serverless-gpu` (databricks#5878). Flips
`acceptance/ssh/connection` to `Local = true` and asserts the bootstrap
job the CLI submits for `ssh connect --cluster` (`existing_cluster_id`,
secret scope, notebook task, `serverless=false`), reusing the testserver
SSH-tunnel stubs from databricks#5878.

The default test cluster (`TestDefaultClusterId`) is now a running
dedicated single-user cluster — the shape `ssh connect --cluster`
requires (`ValidateClusterAccess` rejects anything else), matching the
cloud `TEST_DEFAULT_CLUSTER_ID` it stands in for. Only
`bundle/deployment/bind/cluster` (filters to `cluster_name`) and the
`cmd/api` route stubs reference it, so no other goldens change.

## Tests

- `acceptance/ssh/connection` (asserts the submitted dedicated-cluster
bootstrap job payload)

#5920)

## Changes

Follow-up to #5878, converging the SSH tunnel's two test styles into one
acceptance test. Two enabling changes: derive the driver-proxy websocket
scheme from the host (`http` → `ws`, else `wss`) instead of hardcoding
`wss` so the client can dial the plaintext local test server, and add a
testserver `/ssh` websocket route (via a new connection-hijacking
`Router.HandleRaw`) that upgrades the driver-proxy request to a **real
`sshd -i`** and bridges binary frames to its stdio, standing in for the
tunnel server a real cluster runs — no Databricks compute required.

The `/ssh` handler reads the client public key the CLI uploaded via
`secrets/put` (the ws dial carries the bearer token, so the token-scoped
workspace is the one that stored it), writes an ephemeral host key +
`authorized_keys` + a minimal `sshd_config`, and pumps websocket frames
to and from `sshd`'s stdin/stdout. `/metadata` now returns the current
OS user so `ssh -l <user>` matches the account `sshd` runs as.

`acceptance/ssh/connect-serverless-gpu` now runs a single local `ssh
connect ... -- "echo 'Connection successful'"` that both submits the
serverless-GPU bootstrap job and completes a genuine SSH handshake,
public-key auth, and remote command exec over the `ws://` tunnel,
asserting both the job payload and the command output. This makes
`TestClientServerRealSSHD` redundant, so it's removed; the `cat`-echo
transport tests in `client_server_test.go` remain.

Note the converged test exercises the real handshake on the **client
side only**: the `/ssh` route is a testserver stand-in, not the
production `proxy.NewProxyServer`/`runServerProxy`, so the server
proxy's transport stays covered by the `cat`-echo tests rather than by a
real handshake. This is a deliberate trade-off (`runServerProxy` is
protocol-agnostic), not an accidental coverage drop.

The handshake needs a real OpenSSH server: the test self-skips via
`SKIP_TEST` when `sshd` is absent (the general `test` job doesn't
provision it; `task test-exp-ssh` installs `openssh-server` on Linux).
It's pinned to Linux (`darwin`/`windows` disabled), where running `sshd
-i` as a non-root user with a throwaway config is reliable — matching
the removed Go test's rationale.

## Tests

* `acceptance/ssh/connect-serverless-gpu` (bootstrap job payload + real
SSH handshake and remote exec over the `ws://` tunnel)
* `TestBuildProxyWebsocketURL` (`ws`/`wss` scheme selection)