[v0.3] Expand the sanitized test corpus for sshd and PAM variants

[stacknil]

Summary

• expand the checked-in sanitized corpus used by parser, report-contract, and multi-host regression tests
• cover more realistic sshd and selected PAM family variants without changing detector thresholds
• keep the corpus easy to diff, review, and reason about in pull requests

Scope

• add more sanitized sshd variants across success / failure / disconnect / edge-case paths
• add more selected PAM-family fixtures beyond the current narrow sample set
• add both single-host and multi-host cases where they improve report coverage
• do not change detector thresholds
• do not add enrichment, cross-host correlation, or SIEM-like behavior
• do not add new output formats in this issue

Acceptance Criteria

• the checked-in corpus is meaningfully larger and still fully sanitized
• parser coverage metrics remain deterministic
• existing golden report.md / report.json contract tests still pass
• at least one new multi-host regression case is added or strengthened
• unsupported variants are either explicitly recognized or bucketed deterministically in telemetry