setup-lan-access: Include ~/.ssh/config even if it appears after start

Same rule as c693aa3 (ssh-lan.conf). `Include ~/.ssh/config` went into
~/.ssh-local/config only if ~/.ssh/config was readable at container start.
A file that appeared later, e.g. on a host provisioned after its first
`docker compose up`, was ignored until a restart. Entries ADDED to a file that
already existed were never affected. Measured on tor-ms22 2026-10-19,
expectations written first:
- ssh reads Included files on every connection. A Host added after the config
  was generated resolved with no rerun.
- the bind mount is live: on the Mac, a created file, an atomic replace
  (write + mv) and an append each showed in the container within a second.
So this fixes only the file-appears-later case. The line is now always
written. A file that exists but is unreadable is still left out (ssh would
abort every connection), now with a warning on stderr.

Generated config compared with v1.12.1's: byte-identical when ~/.ssh/config
exists at start (DEVBOX_LAN_ACCESS=jump and auto, with and without
ssh-lan.conf), and stderr is the same too. When the file is absent, the only
difference is the added Include block.
scripts/smoke-test.sh: two new checks, run here the way exec_test runs them
(sh -c). Against v1.12.1, "Included even if created after start" FAILS and
"unreadable left out" PASSES. Against this script both pass, and so do the two
ssh-lan.conf checks.

CHANGELOG Unreleased also names pi-studio v0.10.4 (c83940d), because
check-doc-drift (and so lint on main) had gone red: upstream released 0.10.3
and 0.10.4 right after v1.12.1. 0.10.4 fixes a 0.10.2 Stop regression for
macOS uid -2. Not reachable in the image: 0.10.2's own readStopProcessTable
parsed this container's live ps output (9 rows, min uid 1000). Control: a
macOS-style -2 row throws. The lockfile packages are unchanged, and 0.10.4
loads into pi 1.3.0 with the same 4 studio_* tools, rc 0.

check-doc-drift rc 0, lint-shell rc 0, shellcheck warnings 0 before and after.

scripts/smoke-test.sh

@@ -719,6 +719,28 @@ exec_test "unreadable ssh-lan.conf left out (ssh would abort)" '
   ! grep -q "ssh-lan.conf$" $T/.ssh-local/config &&
   HOME=$T ssh -F $T/.ssh-local/config -G lanpeer >/dev/null 2>&1
   r=$?; rm -rf $T; exit $r'
+# ~/.ssh/config gets the same rule as ssh-lan.conf above: Included whether or
+# not it exists at container start, except when it exists but cannot be read.
+# Entries added to a file that already existed at start were always picked up
+# (ssh reads Includes on every connection, and the mount is live). This covers
+# only a file that appears after start, e.g. a host provisioned after its first
+# `docker compose up`. Through v1.12.1 that file was ignored until a restart.
+exec_test "~/.ssh/config Included even if created after start" '
+  T=$(mktemp -d) &&
+  HOME=$T DEVBOX_LAN_ACCESS=jump bash /usr/local/lib/pi-devbox/setup-lan-access.sh >/dev/null 2>&1 &&
+  grep -qx "Include ~/.ssh/config" $T/.ssh-local/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer 2>/dev/null | grep -qx "hostname ownpeer" &&
+  mkdir -p $T/.ssh && printf "Host ownpeer\n    HostName 10.8.8.8\n" > $T/.ssh/config &&
+  chmod 600 $T/.ssh/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer 2>/dev/null | grep -qx "hostname 10.8.8.8"
+  r=$?; rm -rf $T; exit $r'
+exec_test "unreadable ~/.ssh/config left out (ssh would abort)" '
+  T=$(mktemp -d) && mkdir -p $T/.ssh && printf "Host x\n" > $T/.ssh/config &&
+  chmod 000 $T/.ssh/config &&
+  HOME=$T DEVBOX_LAN_ACCESS=jump bash /usr/local/lib/pi-devbox/setup-lan-access.sh >/dev/null 2>&1 &&
+  ! grep -qx "Include ~/.ssh/config" $T/.ssh-local/config &&
+  HOME=$T ssh -F $T/.ssh-local/config -G ownpeer >/dev/null 2>&1
+  r=$?; chmod 600 $T/.ssh/config; rm -rf $T; exit $r'
 # The vendored mempalace snapshot is refreshed MANUALLY per release (see
 # rootfs/usr/local/share/pi-devbox/skills/VENDORED.md). Through v1.8.4 it also
 # silently SHADOWED the live skillset copy, so staleness was invisible — and the