fix(diagnostic): inspect one protected remaining gateway

[Pigbibi]

Purpose

Allow one existing protected remaining Gateway to be inspected through the existing passive diagnostic. A paused account does not require inspecting every other Gateway at the same time.

Changes

• Add optional remaining_gateway_index. Empty input preserves the current three-target selection.
• Accept one inventory index only in protected remaining passive connection mode; reject the completed target, invalid values, and incompatible modes before cloud authentication.
• Recheck the selected index against the matrix row during protected target resolution.
• Preserve existing identity checks, credentials, permissions, and passive commands.

Verification

Actual resolve and rehydrate tests, workflow shell assertions, actionlint, passive inspection tests, SSH failure classification tests, and diff checks passed. Independent bounded review passed. No broker connection or production change was performed by these checks.