perf(server): dedicated ssh thin handler + fix st alias conflict

provisioning-server-ssh.nu: loads only servers/ssh.nu (~190ms parse).
  Routes both `prvng ssh <host>` and `prvng server ssh <host>`.
  ssh: 931ms → 315ms (-66%).

  bash wrapper: st removed from guide case (setup/state alias conflict
  resolved in favor of state — state | st) wins as pre-existing binding).
  server|s) now routes ssh sub-command to provisioning-server-ssh.nu

cli/provisioning

@@ -1097,7 +1097,7 @@ else
         orchestrator | orch | o)
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-orchestrator.nu" $CMD_ARGS </dev/null
             ;;
-        guide | guides | howto | shortcuts | sc | quickstart | quick | from-scratch | scratch | customize | custom | setup | st)
+        guide | guides | howto | shortcuts | sc | quickstart | quick | from-scratch | scratch | customize | custom | setup)
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-guide.nu" $CMD_ARGS </dev/null
             ;;
         module | mod | layer | lyr | discover | disc)
@@ -1143,6 +1143,9 @@ else
             list|ls|l|sync)
                 $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-list.nu" $CMD_ARGS </dev/null
                 exit $? ;;
+            ssh)
+                $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-ssh.nu" $CMD_ARGS
+                exit $? ;;
             esac
             # Intercept subcommand --help before Nu absorbs it at the top-level main
             _has_help=false
@@ -1168,7 +1171,7 @@ else
         ssh)
             # Shortcut: provisioning ssh <hostname> → provisioning server ssh <hostname> --run
             shift
-            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server.nu" server ssh "$@" --run
+            $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-server-ssh.nu" server ssh "$@" --run
             ;;
         state | st)
             $NU "${NU_ARGS[@]}" "$PROVISIONING/core/nulib/provisioning-state.nu" $CMD_ARGS </dev/null

nulib/provisioning-server-ssh.nu

@@ -0,0 +1,67 @@
+#!/usr/bin/env nu
+# Thin entry for `server ssh` and the `ssh` shortcut.
+# Loads only servers/ssh.nu (~190ms vs ~1s for the full server handler).
+
+export-env {
+    let lib_dirs_raw = ($env.NU_LIB_DIRS? | default "")
+    let current_lib_dirs = if ($lib_dirs_raw | type) == "string" {
+        if ($lib_dirs_raw | is-empty) { [] } else { ($lib_dirs_raw | split row ":") }
+    } else { $lib_dirs_raw }
+    let dynamic = ($env.PROVISIONING? | default "" | path join "core" "nulib")
+    $env.NU_LIB_DIRS = ([
+        "/opt/provisioning/core/nulib"
+        "/usr/local/provisioning/core/nulib"
+    ] | append $current_lib_dirs | append (if ($dynamic | is-not-empty) { [$dynamic] } else { [] }))
+    let args_raw = ($env.PROVISIONING_ARGS? | default "")
+    $env.PROVISIONING_ARGS = ($args_raw | str replace --regex '^(server|s)\s+' '')
+    let _coerce = {|raw| $raw == "true" or $raw == "1" }
+    let raw_debug = ($env.PROVISIONING_DEBUG? | default "")
+    if ($raw_debug | describe) == "string" and ($raw_debug | is-not-empty) {
+        $env.PROVISIONING_DEBUG = (do $_coerce $raw_debug)
+    }
+}
+
+use servers/ssh.nu *
+
+def main [
+    ...args: string
+    --infra (-i): string    = ""
+    --settings (-s): string = ""
+    --run (-r)
+    --debug (-x)
+]: nothing -> nothing {
+    if $debug { $env.PROVISIONING_DEBUG = true }
+    # Strip leading "server"/"s" token if present
+    let first = ($args | get 0? | default "")
+    let rest = if $first in ["server" "s"] { $args | skip 1 } else { $args }
+    let subcmd = ($rest | get 0? | default "ssh")
+    let name   = ($rest | get 1? | default ($rest | get 0? | default ""))
+
+    # Both `prvng ssh <host>` and `prvng server ssh <host>` land here
+    let host = if $subcmd == "ssh" { $name } else { $subcmd }
+    let has_infra    = ($infra    | is-not-empty)
+    let has_settings = ($settings | is-not-empty)
+    let has_host     = ($host     | is-not-empty)
+
+    match [$has_host, $has_infra, $has_settings, $run, $debug] {
+        [true,  true,  true,  true,  true ] => { main ssh $host --infra $infra --settings $settings --debug --run }
+        [true,  true,  true,  true,  false] => { main ssh $host --infra $infra --settings $settings --run }
+        [true,  true,  true,  false, true ] => { main ssh $host --infra $infra --settings $settings --debug }
+        [true,  true,  true,  false, false] => { main ssh $host --infra $infra --settings $settings }
+        [true,  true,  false, true,  true ] => { main ssh $host --infra $infra --debug --run }
+        [true,  true,  false, true,  false] => { main ssh $host --infra $infra --run }
+        [true,  true,  false, false, true ] => { main ssh $host --infra $infra --debug }
+        [true,  true,  false, false, false] => { main ssh $host --infra $infra }
+        [true,  false, true,  true,  true ] => { main ssh $host --settings $settings --debug --run }
+        [true,  false, true,  true,  false] => { main ssh $host --settings $settings --run }
+        [true,  false, true,  false, true ] => { main ssh $host --settings $settings --debug }
+        [true,  false, true,  false, false] => { main ssh $host --settings $settings }
+        [true,  false, false, true,  true ] => { main ssh $host --debug --run }
+        [true,  false, false, true,  false] => { main ssh $host --run }
+        [true,  false, false, false, true ] => { main ssh $host --debug }
+        [true,  false, false, false, false] => { main ssh $host }
+        [false, true,  false, true,  false] => { main ssh --infra $infra --run }
+        [false, true,  false, false, false] => { main ssh --infra $infra }
+        _ => { main ssh }
+    }
+}