wolfsshd: scope the ossh teardown to its run

The OpenSSH certificate test kills its daemon with a pkill pattern. That
pattern now carries $WORK, the mktemp directory this invocation created,
so it names one run's daemon. "sshd_config_ossh" appears on every
concurrent run's command line, so the old pattern took their daemons
down too.

apps/wolfsshd/test/sshd_ossh_cert_test.sh

@@ -49,7 +49,11 @@ command -v ssh-keygen >/dev/null 2>&1 || \
     skip "ssh-keygen not found, skipping OpenSSH cert test"
 
 WORK=$(mktemp -d)
-trap 'pkill -f "wolfsshd .*sshd_config_ossh" 2>/dev/null; rm -rf "$WORK"' EXIT
+# Matched on $WORK, this run's own mktemp dir, not on the config basename:
+# "sshd_config_ossh" appears in every concurrent run's command line too,
+# so the basename pattern tore down another run's daemon along with this
+# one's. $WORK is expanded when the trap fires, by which point it is set.
+trap 'pkill -f "wolfsshd .*$WORK" 2>/dev/null; rm -rf "$WORK"' EXIT
 
 # Under sudo the daemon session runs as the login user: let it traverse $WORK
 # and own the marker dir (not world-writable, so no other user can fake a PASS).
@@ -121,7 +125,7 @@ connect_ssh() { # user-key  cert  remote-command
 
 # (re)start the daemon, drive the selected client, return its exit code.
 attempt() { # user-key  cert  [remote-command]
-    pkill -f "wolfsshd .*sshd_config_ossh" 2>/dev/null
+    pkill -f "wolfsshd .*$WORK" 2>/dev/null
     sleep 1
     "$WOLFSSHD" -D -f "$CONFIG" -E "$WORK/sshd.log" &
     local wp=$!
@@ -175,7 +179,7 @@ echo "scp payload" > "$SCPSRC"
 
 # (re)start the daemon, leaving its PID in DPID.
 start_daemon() {
-    pkill -f "wolfsshd .*sshd_config_ossh" 2>/dev/null
+    pkill -f "wolfsshd .*$WORK" 2>/dev/null
     sleep 1
     "$WOLFSSHD" -D -f "$CONFIG" -E "$WORK/sshd.log" &
     DPID=$!