PR #23437 takeover runtime proof
Baseline: d92c437baa19409f99416a44f748f148f4317c65
Candidate: 741f71d0f820b9c89075fa40ae386a871ee92ec9
Linux OpenSSH, local disposable sshd on 127.0.0.1:22222, temporary agent/key.
Agent key added with ssh-add -c; SSH_ASKPASS=/bin/false refuses approval.
Real SshEnvironmentManager.ensureEnvironment with NodeServices.layer and real child processes.
Prompt callback records requests and returns null. This proves the service prompt boundary, not desktop rendering.

Direct SSH:
sign_and_send_pubkey: signing failed for ED25519 "/tmp/takeover23437/user_key.pub" from agent: agent refused operation
user@127.0.0.1: Permission denied (publickey,password).

Baseline service:
error: SshPasswordPromptError
message: SSH authentication cancelled for user@signing-fixture.
prompts: 1

Candidate service:
error: SshCommandError
message: sign_and_send_pubkey: signing failed for ED25519 "/tmp/takeover23437/user_key.pub" from agent: agent refused operation
user@127.0.0.1: Permission denied (publickey,password).
prompts: 0

Recovery: removed agent identities and re-added the same key without -c.
ssh -o BatchMode=yes signing-fixture true: exit 0.

Remote regression on current main: expected [1] to deeply equal []. Rejected-key control passed.
Remote focused auth/tunnel suites on candidate: 16 passed.
Unverified: packaged Electron desktop, macOS/1Password/Secretive locked-screen path, Windows OpenSSH.
No client rendering changes. Web and mobile do not own the desktop SSH launch/password prompt path.