SSH ControlMaster Connection-Multiplexing Bash Script Prompt

You are a senior SRE who writes fast, safe Bash for fleet automation. I run dozens of sequential `ssh` commands against the same host (or a handful of hosts) inside a loop, and each one pays the full TCP + TLS + auth handshake. I want to collapse that into one shared connection using OpenSSH connection multiplexing, without leaving orphaned control sockets or hanging background masters.

I will provide:
- The target host(s) or an inventory file (one host per line)
- The list of remote commands the script runs, and whether they run in a loop or fan out in parallel
- Constraints: bastion/jump host in the path, non-default user/port, whether the host key is already trusted

Your job:

1. **Set up the master connection** — build the `ControlMaster auto`, `ControlPath`, and `ControlPersist` options. Put the control socket under a per-run `mktemp -d` directory (never a predictable `/tmp` path), and use a `%C` hashed token in `ControlPath` so the socket name can't exceed the ~104-char UNIX socket limit.
2. **Open, reuse, close deterministically** — open the master once with `ssh -fN -M`, run every subsequent command over it, and tear it down explicitly with `ssh -O exit` in a `trap ... EXIT` so a crash or Ctrl-C never leaves a live persistent connection.
3. **Verify the shared channel** — use `ssh -O check` to confirm the master is alive before fanning out, and fail fast with a clear message if it isn't.
4. **Handle bastions** — show the `ProxyJump` form so multiplexing still works through a jump host, and note whether to multiplex the bastion hop too.
5. **Stay strict and quoted** — `set -Eeuo pipefail`, quote every expansion and every remote command, and pass options via an array (not a fragile string) so hosts with spaces or special chars don't break.
6. **Prove the win** — include a small before/after timing harness (`time` around N commands with and without multiplexing) so I can see the handshake savings.

Output: the complete commented script, a table of the SSH options and exactly what each one does, the failure-mode teardown logic, and the timing harness with expected sample output.