V3 approval-gated remote file transfer capability pack. By-value connector composition (service_kind=cli, no separate ingredient): the local OpenSSH scp CLI uploads or downloads a single file over SSH via remote.file_upload and remote.file_download catalog operations. This pack deliberately does not expose generic SSH command execution, recursive copies, globbing, arbitrary flags, ProxyCommand, or host-key bypasses. Each transfer requires an explicit host, user, port, remote path, identity-file path, and known-hosts-file path. scp runs in batch mode with IdentitiesOnly and StrictHostKeyChecking enabled, so a recipe cannot silently accept a new host key or fall back to password prompts. Upload consumes a data.file ref or trusted local path; download captures the fetched file as result.file_ref. Requires OpenSSH scp on PATH (Debian/Ubuntu: apt install openssh-client; macOS: scp ships with OpenSSH). Networked and credential-bearing; approval=ask for every operation.