fix: reconcile required-tools.txt smoke checks (S04.5)

- Replace openssh-client with ssh (checkable binary name)
- Remove socat (not a claude-dev container dependency)
- Handle ca-certificates as special package check in smoke-tools.sh
- Add SPECIAL_CHECKS array for packages without matching binaries

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude-dev/required-tools.txt

@@ -1,6 +1,6 @@
 bash
 ca-certificates
-openssh-client
+ssh
 gh
 git
 jq
@@ -19,5 +19,3 @@ make
 tmux
 tea
 claude
-socat
-

claude-dev/scripts/smoke-tools.sh

@@ -8,11 +8,21 @@ if [[ ! -f "$TOOLS_FILE" ]]; then
   exit 1
 fi
 
+# Special packages that aren't standalone binaries
+declare -A SPECIAL_CHECKS=(
+  ["ca-certificates"]="test -f /etc/ssl/certs/ca-certificates.crt"
+)
+
 missing=()
 while IFS= read -r tool; do
   [[ -z "$tool" ]] && continue
   [[ "$tool" =~ ^# ]] && continue
-  if ! command -v "$tool" >/dev/null 2>&1; then
+
+  if [[ -n "${SPECIAL_CHECKS[$tool]:-}" ]]; then
+    if ! eval "${SPECIAL_CHECKS[$tool]}" >/dev/null 2>&1; then
+      missing+=("$tool")
+    fi
+  elif ! command -v "$tool" >/dev/null 2>&1; then
     missing+=("$tool")
   fi
 done < "$TOOLS_FILE"