Replace pysftp with paramiko to support paramiko >=4

[CasperWA]

Problem / Goal

pysftp 0.2.9 (last released 2016, effectively unmaintained) imports DSSKey from paramiko at module load time.
Paramiko 4.0 removed DSSKey entirely, so any environment that resolves paramiko>=4 fails immediately with ImportError: cannot import name 'DSSKey' from 'paramiko'.
This blocks dependabot's attempt to raise the paramiko ceiling (PR #678) and keeps a known CVE-bearing package pinned.

Context

• Dependabot PR: Update paramiko requirement from <4 to <6 in the python-dependencies group across 1 directory #678 — bumps paramiko<4 → <6, installs paramiko 5, breaks CI
• Failing tests: tests/strategies/download/test_sftp.py::test_sftp and tests/strategies/test_strategies_general.py::test_registered_entry_point_importability
• Relevant files: oteapi/strategies/download/sftp.py, tests/strategies/download/test_sftp.py, pyproject.toml
• pysftp is the only consumer of paramiko in the codebase — sftp.py has zero direct import paramiko statements
• CVE-2026-44405 (paramiko/SHA-1) already flagged by pip-audit on PR Pin RabbitMQ broker image to 3.x in Celery tests #681; pinning <4 is the root cause

Reproduction

pip install "paramiko>=4"
python -c "import pysftp"
# ImportError: cannot import name 'DSSKey' from 'paramiko'

Considerations

Is a paramiko 5 upgrade feasible without a major overhaul?
Yes — the rewrite is self-contained in one strategy file (~25 lines of logic) and one test file.
No other file in the codebase imports paramiko or pysftp.

Chosen approach: replace pysftp with direct paramiko calls

oteapi/strategies/download/sftp.py currently uses:

• pysftp.CnOpts() with hostkeys = None — replaced by paramiko.SSHClient + AutoAddPolicy
• pysftp.Connection(host, username, password, port, cnopts) — replaced by client.connect() + client.open_sftp()
• sftp.get(remotepath, localpath=...) — replaced by sftp.get(remotepath, str(localpath))

pyproject.toml changes:

• Remove pysftp~=0.2.9
• Change paramiko<4 → paramiko<6
• Remove the filterwarnings entry for pysftp HostKeys warning

Alternative: vendor/patch pysftp
No maintained fork exists on PyPI; vendoring a patched copy adds maintenance burden for a library whose entire role is now a thin wrapper around a three-line paramiko call sequence.

Acceptance Criteria

• pysftp is removed from all dependencies
• paramiko<4 constraint is lifted to <6
• oteapi/strategies/download/sftp.py uses paramiko directly
• All existing tests pass on all supported Python versions