Prevent Lightsail SSH certificate expiry during deployments

[crohr]

Summary

• record the expiration returned with Lightsail SSH access details
• replace expiring AWS credentials with a run-scoped Ed25519 key after initial SSH readiness
• enforce a 12-hour server-side expiry and remove the key best-effort when deployment finishes
• rebuild the bundled Linux amd64 action binary

Validation

• make test
• mise exec -- go test ./...
• mise exec -- go test -race ./internal/pullpreview ./internal/providers/lightsail
• mise exec -- go vet ./...
• upx -t dist/pullpreview-linux-amd64
• clean GPT-5.6-sol xhigh adversarial review

Closes#138

[crohr]

@codex review

[phindmarsh]

I tested #139 twice against our longer Lightsail deployment, pinned to the exact PR head commit:

pullpreview/action@1ebf6c794ff8ac84508aade418cd4f95f5c59844

Unfortunately, both runs still failed when a later Docker-context SSH connection was opened.

Run 1:

• Fresh Lightsail instance created at 21:04:28
• SSH readiness succeeded at 21:06:25
• Docker context created at 21:06:49
• At 21:12:45, Compose opened another connection and received: Permission denied (publickey,gssapi-keyex,gssapi-with-mic)
• Time from Instance created to authentication failure: about 8m 16s

Run 2:

• Fresh Lightsail instance created at 20:59:07
• SSH readiness succeeded at 21:01:34
• Docker context created at 21:02:04
• At 21:07:24, Compose opened another connection and received: Permission denied (publickey,gssapi-keyex,gssapi-with-mic)
• Time from Instance created to authentication failure: about 8m 17s

In both runs:

• GitHub confirmed it downloaded and ran commit 1ebf6c7
• deployment progressed normally for several minutes before authentication began failing
• Established run-scoped SSH access for deployment never appeared
• the final failure was Docker-over-SSH exit status 255

Given that handoffExpiringSSHAccess() is called after SSH readiness and returns early when Access.ExpiresAt.IsZero(), the missing handoff message appears to indicate that the Lightsail ExpiresAt value is arriving as a zero time. The action consequently continues using the temporary AWS certificate,
which then expires during Compose.

It may be worth logging the received ExpiresAt value and triggering the run-scoped key handoff whenever a Lightsail CertKey is present, even if ExpiresAt is missing or zero.