Fix known-hosts trust deadlock, host key stat, and optional nozstd build

- stdout logger: release mutex while waiting on pause resume so prompt
  callbacks can log (fixes hang after trusting new hosts; known_hosts
  was written but Resume never ran).
- known hosts callback: stop borrowing the SSH dial throttle channel
  (could block or interact badly with parallel handshakes).
- host key path: use errors.Is(..., fs.ErrNotExist) for RootedPath.Stat
  wrapped errors; stat errors now fail fast instead of mis-read.
- public key path: same ErrNotExist check for authorized_keys miss.
- Build: optional DTAIL_NO_ZSTD=yes / nozstd tag for CGO-free builds;
  split zstd readers into tagged files.
- Docs/examples: firewalld note for port 2222, log prune timer+script,
  SSHBindAddress note, dserver unit disabled-by-default comment;
  firewalld helper script example.
- Regression test for stdout pause/mutex behavior.

Made-with: Cursor

1 files changed, 10 insertions, 0 deletions

diff --git a/examples/prune_dserver_logs.sh.example b/examples/prune_dserver_logs.sh.example
new file mode 100644
index 0000000..56a68cd
--- /dev/null
+++ b/examples/prune_dserver_logs.sh.example
@@ -0,0 +1,10 @@
+#!/bin/bash
+
+declare -r LOGDIR=/var/run/dserver/log
+
+if [ ! -d "$LOGDIR" ]; then
+	exit 0
+fi
+
+# Daily rotated logs: YYYYMMDD.log — remove files not modified in the last 7 days.
+/usr/bin/find "$LOGDIR" -type f -name '*.log' -mtime +7 -delete