fix: a release job uses only the key it is given, never the runner's own

Measured on a throwaway Gitea: with the key secret unset, Preview's
publish job would have fallen back to the runner machine's own ssh
configuration — on the development VM, the production publish key — and
published a throwaway 9.9.9 to the real server. It was cancelled before
it ran. And with the key set, the job wrote over the runner account's own
~/.ssh/config and known_hosts.

Now, under Actions, a job without RELEASE_SSH_KEY stops; with it, the key,
its known_hosts and an ssh configuration live in the job's own directory
and every ssh and rsync goes through `ssh -F` (RELEASE_SSH_CONFIG in
release-lib), which reads nothing else. The key is deleted when the job
ends. By hand, nothing changes. Also records the end-to-end measurements
of Release 1 and of Preview's gate job in docs/releasing.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tests/test-release-versions.sh

@@ -86,6 +86,11 @@ cp "$SERVER/canary/manifest.json" "$LOCAL/canary/"
 # to one host, and it is this directory.
 cat > "$WORK/bin/ssh" <<'EOF'
 #!/bin/bash
+# ssh [-F CONFIG] HOST COMMAND: run COMMAND here, and note which
+# configuration it was given ("-" for the machine's own).
+config=-
+if [[ "$1" == -F ]]; then config="$2"; shift 2; fi
+echo "ssh $config" >> "${SSH_LOG:-/dev/null}"
 shift
 exec bash -c "$*"
 EOF
@@ -98,7 +103,7 @@ args=()
 while [[ $# -gt 0 ]]; do
     case "$1" in
         --ignore-existing) keep=1 ;;
-        -e) shift ;;
+        -e) echo "rsync $2" >> "${SSH_LOG:-/dev/null}"; shift ;;
         -*) ;;
         *) args+=("$1") ;;
     esac