Close block-owned SSH sessions on nonlocal exits

[OskarEichler]

Summary

Ensure normal block exits, return, break and throw close the owned SSH session. Keep the existing exception shutdown path and original exception propagation.

Reproduction

catch(:done) { Net::SFTP.start(host, user) { throw :done } } bypasses the current close call and rescue block. A local fake SSH connection records no cleanup on baseline and exactly one close after this patch.

Verification

• Baseline and this isolated patch: 433 existing tests, 1,201 assertions, zero failures/errors/skips, Ruby 4.0.6 through rbenv, net-ssh 7.3.3, Minitest 5.27.0 and Mocha 2.1.0.
• 19 external assertions cover normal/blockless calls, throw/break/return, setup errors, StandardError, Interrupt, close failure and shutdown failure. These checks replace Net::SSH.start with a local object; no remote server is required.
• The combined consumer candidate also passes 10,384 external model assertions, 21 local OpenSSH pipe assertions, and the existing suite with frozen string literals enabled and disabled. These combined checks include separately attributed portions of Handle frozen strings #157/ensure ruby 4 compatibility and address some security concerns #162; they are not claimed as this isolated branch's changes.
• Packaging preserves all 37 release paths and dependency metadata. All 26 runtime files compile on Ruby 4.0.6 and parse with Parser::Ruby25. Comparative Lint checks retain the same 33 baseline findings; no all-green lint claim.

Breaking changes and limitations

Intentional lifecycle correction: sessions owned by the block form are now closed on nonlocal exits. Blockless calls still return an open session. No signature change. PR #162 changes exception handling but does not fix this nonlocal-exit path; those changes are not duplicated.

No repository tests were added or modified under the contribution's no-new-tests constraint; focused repro/model drivers ran outside the repository. An external verification Gemfile supplies compatible test tools and RDoc without changing upstream tooling. Actual older Ruby/JRuby/Windows compatibility and upstream CI have not been verified. No production or SSH connections, version bumps, release-tool changes or unrelated modernization are included. Git builds are not signed by the upstream gem release key.