test(mapping): complete the decline-matrix contract suite (w5-decline-matrix)

- coverage audit recorded in the task file: every mapping.md row ×
  every build it can appear in × both directions → the pinning test
- gap rows landed in tests/dispatch_core.rs: the streamlocal_forward
  decline, the cancel-form refusions, the git-build pty decline
- never-features pinned in every build both directions; the auth-agent
  open recorded pin-bound upstream (russh 0.65 declines AgentForward
  opens pre-handler; no client initiator at the pin)
- sftp-only build verified no-op + declining via the matrix run
- matrix runner landed: scripts/matrix.sh (cargo test × 6 builds,
  clippy ×2 -D warnings, fmt, doc), joined AGENTS.md verification list

Verification: scripts/matrix.sh green end to end

scripts/matrix.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# The decline-matrix runner (tasks/implementation/w5-decline-matrix.md):
+# the per-build verification set as one command — `cargo test` per
+# feature build (none / git / session / tunnel / sftp-only /
+# --all-features; the sftp-only run is the no-op-feature fact itself
+# verified), clippy ×2 (-D warnings, with and without
+# --all-features), fmt, doc.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+default_build="none (default = [])"
+for build in "" "--features git" "--features session" "--features tunnel" "--features sftp" "--all-features"; do
+    label="${build:-$default_build}"
+    echo "== cargo test [$label]"
+    cargo test $build
+done
+
+echo "== clippy (no all-features)"
+cargo clippy --all-targets -- -D warnings
+echo "== clippy (all-features)"
+cargo clippy --all-features --all-targets -- -D warnings
+echo "== fmt"
+cargo fmt --check
+echo "== doc"
+cargo doc --no-deps