setup-lan-access: Include ~/.ssh/config even if it appears after start

Same rule as c693aa3 (ssh-lan.conf). `Include ~/.ssh/config` went into
~/.ssh-local/config only if ~/.ssh/config was readable at container start.
A file that appeared later, e.g. on a host provisioned after its first
`docker compose up`, was ignored until a restart. Entries ADDED to a file that
already existed were never affected. Measured on tor-ms22 2026-10-19,
expectations written first:
- ssh reads Included files on every connection. A Host added after the config
  was generated resolved with no rerun.
- the bind mount is live: on the Mac, a created file, an atomic replace
  (write + mv) and an append each showed in the container within a second.
So this fixes only the file-appears-later case. The line is now always
written. A file that exists but is unreadable is still left out (ssh would
abort every connection), now with a warning on stderr.

Generated config compared with v1.12.1's: byte-identical when ~/.ssh/config
exists at start (DEVBOX_LAN_ACCESS=jump and auto, with and without
ssh-lan.conf), and stderr is the same too. When the file is absent, the only
difference is the added Include block.
scripts/smoke-test.sh: two new checks, run here the way exec_test runs them
(sh -c). Against v1.12.1, "Included even if created after start" FAILS and
"unreadable left out" PASSES. Against this script both pass, and so do the two
ssh-lan.conf checks.

CHANGELOG Unreleased also names pi-studio v0.10.4 (c83940d), because
check-doc-drift (and so lint on main) had gone red: upstream released 0.10.3
and 0.10.4 right after v1.12.1. 0.10.4 fixes a 0.10.2 Stop regression for
macOS uid -2. Not reachable in the image: 0.10.2's own readStopProcessTable
parsed this container's live ps output (9 rows, min uid 1000). Control: a
macOS-style -2 row throws. The lockfile packages are unchanged, and 0.10.4
loads into pi 1.3.0 with the same 4 studio_* tools, rc 0.

check-doc-drift rc 0, lint-shell rc 0, shellcheck warnings 0 before and after.

CHANGELOG.md

@@ -11,6 +11,45 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
+## Unreleased
+
+### Changed
+
+- **pi-studio `v0.10.2` → `v0.10.4`** (`c83940d`, `-studio` tags only). Two
+  upstream patch releases on 2026-10-19. 0.10.3: IPython prints a value once
+  (`Out[5]: …`), not twice, and after a Quick send the cursor returns to the
+  input box. 0.10.4: Stop works again on a Mac that has a process running as
+  `nobody`. That was a 0.10.2 regression: macOS lists that uid as `-2`, and the
+  0.10.2 parser refused to stop anything. **It does not affect the image**:
+  inside the container, `ps` shows only the container's own processes, and none
+  has a negative uid. Measured 2026-10-19 on tor-ms22. 0.10.2's own
+  `readStopProcessTable` parsed the live process table (9 rows, min uid 1000).
+  Control: a macOS-style `-2` row made it throw "Could not parse process
+  ownership data". Dependencies unchanged: `package-lock.json` packages are
+  identical to 0.10.1's, and `ws` is still the only runtime dependency. Loaded
+  into pi `1.3.0` with `pi --no-extensions -e <clone>/index.ts -p`, it registers
+  the same four `studio_*` tools, rc 0.
+
+### Fixed
+
+- **`~/.ssh/config` is Included even if it appears after the container
+  started.** Same rule as the `ssh-lan.conf` fix in v1.12.1. `setup-lan-access.sh`
+  wrote `Include ~/.ssh/config` into `~/.ssh-local/config` only if
+  `~/.ssh/config` was readable at container start, so a file that appeared
+  later (a host provisioned after its first `docker compose up`) was ignored
+  until a restart. Entries *added* to a file that already existed were never
+  affected: ssh reads Included files on every connection, and the bind mount is
+  live. Measured 2026-10-19 on tor-ms22: on the Mac, a newly created file, an
+  atomic replace (write + `mv`, as editors do) and an append each showed up in
+  the container within a second. The line is now written whether or not the
+  file exists. A file that exists but is unreadable is still left out, with a
+  warning on stderr, because ssh would abort every connection. When the file
+  exists at start the generated config is byte-identical to v1.12.1's (checked
+  with and without `ssh-lan.conf`). When it is absent, the only difference is
+  the added Include block. `scripts/smoke-test.sh` gains two checks, Included
+  when created after start and left out when unreadable. Against the v1.12.1
+  script the first fails and the second passes; against this one both pass.
+
 ## v1.12.1 — 2026-10-19
 
 Patch release. Headline: **`ssh-lan.conf` is Included even if it is created