docs: verify TLS certificates in SSH tunnel commands

[phala-agent]

Summary

• Add fail-closed certificate verification to both documented SSH tunnel commands.
• Use the complete app-port gateway hostname for SNI and hostname verification, preserving gateway routing.

Verification

• git diff --check
• bash -n build.sh scripts/install-openssh.sh scripts/mount-overlay.sh
• Both SSH config examples parsed with ssh -G; instantiated commands passed shell syntax checks.
• Local OpenSSL 3.5.7 TLS checks against both commands: trusted matching certificate accepted; wrong hostname and untrusted certificate rejected before SSH banner delivery; full SNI confirmed in all six cases.

Temporary verification artifacts remain outside the repository. Production connections and LibreSSL were not exercised.