fix(runner): admit verified suspended SSH backups on restart

SSH already persists suspended harness backups. Permit the same integrity and full-scope verification used by sandbox targets during a cold controller continuation.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/services/native-runtime/native-session-executor.ts

@@ -7729,9 +7729,7 @@ async function executePaperclipNativeSessionWithinScope(
     retainedTransition = await migrateRunnerdStateRootForExecution({
       db: input.db,
       execution: input.execution,
-      allowVerifiedBackup:
-        input.runnerExecutionTarget?.kind === "remote" &&
-        input.runnerExecutionTarget.transport === "sandbox",
+      allowVerifiedBackup: input.runnerExecutionTarget?.kind === "remote",
       // A retained warm runner is deliberately still ready rather than
       // suspended. Only the exact idle in-process owner may rotate that
       // prior-run authority; after a hard restart the map is empty and the
@@ -11198,9 +11196,7 @@ export async function createRunnerdBackend(input: {
       retainedTransition = await migrateRunnerdStateRootForExecution({
         db: input.db,
         execution: input.execution,
-        allowVerifiedBackup:
-          input.runnerExecutionTarget?.kind === "remote" &&
-          input.runnerExecutionTarget.transport === "sandbox",
+        allowVerifiedBackup: input.runnerExecutionTarget?.kind === "remote",
         allowRetainedWarmRunner: false,
         allowLocalRecovery: input.runnerExecutionTarget?.kind !== "remote",
         onLog: input.onLog,