- The tunnel is `ssh -W` to the console's address or Unix socket: the
compute needs no nc and runs no shell. The old tunnel, copied from
virt-manager, built a shell script with the console's address and socket
path in it and eval'd it on the compute, and always passed "-p 22",
overriding a Port in the SSH configuration.
- On an SSH compute the console always goes through the tunnel, also when
it listens on a network address: it was sent there unencrypted.
- ssh never prompts (BatchMode) and gives up connecting after 10 seconds;
when it fails, what it said is logged. The tunnel ends with the session.
