fix: keep Guacamole VRDE tunnel alive

docs/implementation-plan.v1.md

@@ -888,7 +888,8 @@ invisible Guest Control session must never answer it.
 When that bounded manual step is necessary, use the tracked Docker-only
 [`test/rdp-access`](../test/rdp-access/README.md) helper. It starts a
 self-signed HTTPS Guacamole gateway only after `test-host prepare` holds the
-fixture lease; VRDE remains loopback-only on Helium and its SSH tunnel is bound
+fixture lease; VRDE remains loopback-only on Helium and its reconnecting SSH
+watchdog/tunnel is bound
 only to the helper's private Docker gateway. Stop the helper before the normal
 `test-host reset`. It is a recovery interface, not a product component or a
 replacement for Guest Control/native test automation.

docs/testing-vm.md

@@ -88,7 +88,8 @@ and collection. Do not expose the VM's RDP endpoints beyond the test LAN.
 For the rare interactive UAC/manual-recovery step, use the Docker-only helper
 in [`test/rdp-access`](../test/rdp-access/README.md). It creates a temporary
 self-signed HTTPS Guacamole gateway while retaining VRDE on Helium loopback and
-the SSH tunnel on a private Docker gateway. Follow its full lease/prepare/up/
+the reconnecting SSH watchdog/tunnel on a private Docker gateway. Follow its
+full lease/prepare/up/
 down/reset lifecycle; it is not an alternative to the native test controller.
 
 ## Snapshots and reset contract