Crash after successful SSH password authentication before pty-req/shell request on macOS

# Crash after successful SSH password authentication before pty-req/shell request on macOS

## Summary

WindTerm crashes every time when connecting to one specific SSH server. The same account and server work correctly with OpenSSH and FinalShell.

Server-side `sshd -ddd` logs show that password authentication and PAM session opening both succeed, and WindTerm opens an SSH `session` channel. However, WindTerm never sends `pty-req` or `shell`; it immediately sends EOF/close, then the macOS WindTerm process crashes.

This looks like a WindTerm client-side crash in the SSH session/shell creation path, not a server-side login failure.

## Environment

- WindTerm version: 2.6.0
- OS: macOS 15.7.7
- WindTerm binary architecture: x86_64
- Hardware: Apple Silicon Mac running WindTerm under Rosetta
- Protocol: SSH
- Authentication: password auto-login
- Server: OpenSSH_9.2p1 Debian-2+deb12u9
- Server OS: Debian GNU/Linux, kernel 6.1.x amd64
- SSH port: custom port, reproducible on both the normal port and a temporary debug `sshd -ddd` port

## Expected Behavior

After password authentication succeeds, WindTerm should request a PTY and shell, then open the terminal session normally.

## Actual Behavior

WindTerm crashes after SSH authentication succeeds, before sending `pty-req` or `shell` to the server.

Other SSH clients can connect to the same server/account successfully:

- OpenSSH client: works
- FinalShell: works

## Reproduction Steps

1. Create a new SSH session in WindTerm.
2. Use password authentication / auto-login.
3. Connect to the affected OpenSSH server.
4. Authentication succeeds on the server side.
5. WindTerm closes the SSH channel before requesting PTY/shell and then crashes.

The issue still reproduces after deleting the WindTerm session entry and recreating it from scratch.

## Server-side Debug Evidence

I started a temporary debug `sshd` on another port:

```bash
sudo mkdir -p /run/sshd
sudo /usr/sbin/sshd -D -ddd -f /etc/ssh/sshd_config -p 22222 -E /tmp/sshd-windterm-debug.log
```

Then I connected to that temporary debug port from WindTerm. The relevant server-side log sequence is:

```text
PAM: password authentication accepted
Accepted password for from port ssh2
PAM: opening session
active: key options: agent-forwarding port-forwarding pty user-rc x11-forwarding
Entering interactive session for SSH2.
server_input_channel_open: ctype session rchan 43 win 64000 max 261120
input_session_request
channel 0: new session [server-session]
session_new: session 0
session_open: channel 0
server_input_channel_open: confirm session
channel 0: rcvd eof
channel 0: rcvd close
session_close_by_channel: channel 0 child 0
Close session: user from port id 0
Connection closed by port
PAM: closing session
```

Important point: there is no `pty-req`, no `shell`, and no `exec` request in the server log. The client closes the channel immediately after the server confirms the SSH session channel.

## macOS Crash Report Stack

The macOS crash report consistently shows an `EXC_BAD_ACCESS` / segmentation fault in the WindTerm SSH shell/session creation path. The relevant stack frames are:

```text
QtSharedPointer::ExternalRefCountData::getAndRef(QObject const*)
SuperSession::createTerm
SuperCommander::createMainTerm
SuperSession::onSshShellCreated
SshBridge::shellCreated
SshBridge::createShell::$_19::operator()
SshOperator::abort
SshOperator::onComplete
QTimer::timerEvent
```

The crash happens after the TCP connection and SSH authentication have already succeeded.

## Additional Observations

- The same server/account works with OpenSSH and FinalShell.
- Recreating the WindTerm session from scratch does not help.
- Disabling public-key authentication and GSSAPI in the WindTerm session config does not help.
- A known-good server with the same OpenSSH server version works in WindTerm.
- Another WindTerm session with almost identical non-sensitive session settings works.
- The affected server advertises `publickey,password`, but other working servers also advertise public-key authentication, so this does not appear to be only a public-key advertisement issue.
- The crash is reproducible on both the normal sshd port and a temporary `sshd -ddd` debug port.

## Why this appears client-side

The server accepts the password, opens the PAM session, enters interactive SSH mode, and confirms the SSH `session` channel. WindTerm then closes the channel before requesting PTY or shell. Since OpenSSH and FinalShell work against the same server/account, this looks like a WindTerm-specific failure in the post-auth SSH session/shell creation flow.

Please let me know if you need the full anonymized macOS `.ips` crash report or the full anonymized `sshd -ddd` log.

i had try 2.7.0 ,it show like 2.6.0 ,it exit suddently

Start by reproducing the macOS crash and tracing the reported stack from SshOperator::abort through SshBridge::shellCreated, SuperSession::onSshShellCreated, and SuperSession::createTerm. Compare the server's sshd -ddd sequence with a working session, focusing on the post-auth SSH session and shell creation path. Done means the client no longer crashes and sends the expected pty-req and shell requests.

Written by the indexing model from the issue text.