fix: a release job uses only the key it is given, never the runner's own

Measured on a throwaway Gitea: with the key secret unset, Preview's
publish job would have fallen back to the runner machine's own ssh
configuration — on the development VM, the production publish key — and
published a throwaway 9.9.9 to the real server. It was cancelled before
it ran. And with the key set, the job wrote over the runner account's own
~/.ssh/config and known_hosts.

Now, under Actions, a job without RELEASE_SSH_KEY stops; with it, the key,
its known_hosts and an ssh configuration live in the job's own directory
and every ssh and rsync goes through `ssh -F` (RELEASE_SSH_CONFIG in
release-lib), which reads nothing else. The key is deleted when the job
ends. By hand, nothing changes. Also records the end-to-end measurements
of Release 1 and of Preview's gate job in docs/releasing.md.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

tools/release-lib.sh

@@ -66,8 +66,26 @@ release_package_version() {
     dpkg-deb --field "$1" Version
 }
 
+# ssh to the update server. With RELEASE_SSH_CONFIG, that file and nothing
+# else configures it — `ssh -F` ignores ~/.ssh/config and the system's — so
+# a release job uses only the key it was given, and never the credentials
+# of whatever machine it happens to run on. Without it, this machine's own
+# configuration, as a person publishing by hand always has.
+release_ssh() {
+    if [[ -n "${RELEASE_SSH_CONFIG:-}" ]]; then
+        ssh -F "$RELEASE_SSH_CONFIG" "$@"
+    else
+        ssh "$@"
+    fi
+}
+
+# The same, as rsync's -e.
+release_rsync_ssh() {
+    printf 'ssh%s\n' "${RELEASE_SSH_CONFIG:+ -F $RELEASE_SSH_CONFIG}"
+}
+
 release_remote() {
-    ssh "$RELEASE_HOST" "$@"
+    release_ssh "$RELEASE_HOST" "$@"
 }
 
 # Every version that has ever been published, one per line, read from the
@@ -151,7 +169,7 @@ release_upload_package() {
     name="$(basename "$package")"
     local_hash="$(sha256sum "$package" | awk '{print $1}')"
 
-    rsync -av --ignore-existing -e ssh \
+    rsync -av --ignore-existing -e "$(release_rsync_ssh)" \
         "$package" "$RELEASE_HOST:$RELEASE_ROOT/packages/"
 
     remote_hash="$(release_remote "sha256sum '$RELEASE_ROOT/packages/$name'" | awk '{print $1}')"
@@ -192,7 +210,7 @@ release_publish_manifest() {
 EOF
 
     # Manifest deliberately goes LAST, after the package it names.
-    rsync -av -e ssh \
+    rsync -av -e "$(release_rsync_ssh)" \
         "$RELEASE_LOCAL/$channel/manifest.json" \
         "$RELEASE_HOST:$RELEASE_ROOT/$channel/manifest.json"