[barislabs]

Hi! I’m a fan of Project CETI and its mission, and I’m glad to contribute a small improvement to the project. This patch adds connection cleanup protection related to #41.

When SSH setup fails before open_sftp() returns, download_remote_file's finally
block currently references an unassigned SFTP client and skips SSH cleanup.
An SFTP close failure can also prevent the SSH client from closing.

Use a small cleanup context manager for locally owned SSH clients and nest the
download's SFTP lifetime within its SSH lifetime. This closes acquired resources
on success and failure, attempts SSH cleanup after an SFTP close failure, and
preserves the original operation error if cleanup also fails. Apply the same
ownership rule to the related SSH helpers while keeping their existing return
values, exception handling, commands, and download paths.

Add 21 offline regression tests covering acquisition and transfer failures,
interruption, cleanup errors, repeated failures, success paths, hash filtering,
and preflight early returns. Tests use dependency doubles held in memory and block
socket connections; they do not require AWS or hardware.

Validation: unittest passes on Windows Python 3.9.25 and 3.14; pytest reports
21 tests and 26 subtests passing on Python 3.14. The isolated test loader defers
the existing discovery annotation; this does not establish production import
compatibility with older Python versions.
The regression suite fails against the original main branch source. Fatal error
flake8 and full lint for the new tests pass, as do syntax and whitespace checks.
Modern mypy reports the same three existing errors before and after the change.
Full Linux and Python version matrix CI and the existing real AWS upload test were not run.
An independent read only review found no unresolved issue after the test loader
compatibility correction and independently reran the revised tests successfully.

Overlap: #36 includes partial download cleanup guards alongside progress bars.
This patch focuses on connection lifetime and covers SFTP close failures and
related SSH helpers. It does not include the functionality or infrastructure
from #36, #37, #43, #44, or #45. If those land first, this patch needs reconciliation.