[Enhancement] Maximize deny_remote coverage in functional test suite

[mcdope]

Summary

CI globally disabled deny_remote before running any tests (via a workflow step patching <defaults> directly), because the functional suite is driven entirely over SSH and deny_remote (which defaults to true) would otherwise deny every pamusb-check call. As a result, the sshd parent-process-chain detection path in local.c had zero test coverage — the one feature this CI environment is naturally positioned to exercise (since it always runs over SSH) was the one thing disabled before tests ran.

• Adds test-check-deny-remote-ssh.sh, which exercises the sshd-ancestry denial path directly (no device/user setup needed, since the check fires before device inspection). It skips gracefully when not actually run over SSH, since there's no env var to fake an sshd ancestor (unlike XRDP_SESSION).
• Replaces the blanket global disable with a bypass scoped to just the current CI user's <user> config entry, gated behind a new PAMUSB_CI_MODE=1 env var passed from the workflow. This keeps deny_remote enforced for everything except the handful of tests that need a successful pamusb-check call from the SSH-driven runner.
• Removes the old "disable deny_remote option" workflow step entirely.

Why this approach

Scoping the bypass to the specific user (rather than <defaults>) means deny_remote stays "on" by default for the whole suite, and only the tests that structurally require a granted auth over SSH get an explicit, narrow opt-out — instead of the feature being untested end-to-end. Tests that build their own temp config from a copy of the live config (test-check-many-devices.sh, test-check-superuser-filtering.sh) automatically inherit the scoped bypass with no changes needed on their end.

Closes #420

Test plan

• bash -n syntax check on the new/modified shell scripts
• Verified locally that test-check-deny-remote-ssh.sh skips gracefully (exit 0) when not run over SSH
• Full tests/can-actually-be-used/run-tests.sh run on the dedicated CI runner (real SSH session) confirming: new test denies + logs the expected message, and test-check-verify-created-config.sh / test-check-many-devices.sh / test-check-superuser-filtering.sh still pass under PAMUSB_CI_MODE=1
• make test

🤖 This PR was generated with the assistance of Claude Code

I have read the rules