[Steve Lee (SteveL-MSFT)]

sshdconfig reports "elevated security context required" for both missing host keys and permission failures from sshd -T, hiding the actual failure even when DSC is elevated.

Preserve the complete original OpenSSH diagnostic through the existing command-error path. Validation behavior stays unchanged: no automatic key generation, service startup, permission changes, or bypass of failed validation. Add focused regression coverage and document host-key initialization and troubleshooting.

Validation

• Targeted build.ps1 build and Clippy passed.
• All 37 Rust tests passed. The new diagnostic regression failed against the previous translation and passed after the fix.
• Pester: 5 passed, 64 skipped, 0 failed. Although sshd is now installed, this session is not elevated; sshd -T also reports a missing default configuration. Full OpenSSH integration coverage remains unverified.

Fixes: #1806

[Copilot]

🟢 Approval recommended

No active review issues remain for the change preserving SSHD validation diagnostics.

No open issues 🎉

What changed in this PR

Addresses #1806 by preserving OpenSSH validation diagnostics in the SSHD configuration resource instead of replacing host-key and permission errors with a generic elevation message. Failed validation still blocks the operation.

Changes:

• Preserve original diagnostics through the existing command-error path.
• Add regression tests for failure diagnostics and successful output.
• Document host-key prerequisites, initialization, and permission troubleshooting.

File	Description
resources/​sshdconfig/​src/​util.rs	Extracts output parsing, removes diagnostic replacement, and adds regression tests.
resources/​sshdconfig/​locales/​en-us.toml	Removes the unused generic elevation message.
docs/​reference/​resources/​Microsoft/​OpenSSH/​SSHD/​sshd_config/​index.md	Documents host-key requirements and validation troubleshooting.

_{Review effort: Balanced}