fix: reconcile required-tools.txt smoke checks (S04.5)

- Replace openssh-client with ssh (checkable binary name)
- Remove socat (not a claude-dev container dependency)
- Handle ca-certificates as special package check in smoke-tools.sh
- Add SPECIAL_CHECKS array for packages without matching binaries

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude-dev/required-tools.txt

@@ -1,6 +1,6 @@
 bash
 ca-certificates
-openssh-client
+ssh
 gh
 git
 jq
@@ -19,5 +19,3 @@ make
 tmux
 tea
 claude
-socat
-