setup-lan-access: Include ssh-lan.conf even if it is created after start

The Include for ~/.config/devbox-shell/ssh-lan.conf was written only if the
file was readable at container start. A file created afterwards was visible in
the container and silently ignored. Hit on EMB-3HXGNXJ0 on 2026-10-18: the
tor-ms22 override was skipped, ssh fell through to the Mac's passphrase key,
and BatchMode got "Permission denied (publickey,...)" until the script was
rerun by hand.

The line is now always written. Measured with this image's OpenSSH 10.0p2,
expectations written before each run:
- file missing, and also its parent directory missing: Include skipped, rc 0
- file created after the config was written: read on the next ssh, no rerun
- a directory at that path: ignored, rc 0
- file present but unreadable: ssh aborts EVERY connection ("Can't open user
  config file"). So that case is still left out, now with a warning on stderr.
- world-writable file: "Bad owner or permissions". The old code Included that
  case too, so nothing changes there.
When the file exists at start, the generated config is byte-identical to
v1.12.0's. When it is absent, the only difference is the added Include block.

scripts/smoke-test.sh: two new checks, "Included even if created after start"
and "unreadable left out". Run here, the way exec_test runs them: against the
v1.12.0 script the first FAILs and the second PASSes; against this one both
PASS. README "Naming LAN peers": creating the file no longer needs a restart.
CHANGELOG: Unreleased > Fixed.

lint-shell: clean. check-doc-drift still fails, as it already did on HEAD:
pi-toolkit 3760d90->7c05901 and pi-studio 76db01f->4b4abd1 have moved upstream
since v1.12.0 and are not named in the CHANGELOG. That is release prep and is
not addressed here.

CHANGELOG.md

@@ -11,6 +11,30 @@ Pre-v1.0.0 tags followed the pi npm version (`v{pi_version}[letter]`).
 
 ---
 
+## Unreleased
+
+### Fixed
+
+- **`~/.config/devbox-shell/ssh-lan.conf` is Included even if it is created
+  after the container started.** `setup-lan-access.sh` wrote the
+  `Include ~/.config/devbox-shell/ssh-lan.conf` line only if the file was
+  readable at container start. A file created afterwards was visible in the
+  container and silently ignored, so ssh fell through to `~/.ssh/config`. Hit on
+  EMB-3HXGNXJ0 on 2026-10-18: its `tor-ms22` override (container key, no
+  passphrase) was skipped. ssh then used the Mac's passphrase-protected key, and
+  `BatchMode` failed with `Permission denied (publickey,…)`. Rerunning the script
+  inside the container fixed it. The line is now written whether or not the file
+  exists. With this image's OpenSSH 10.0p2, an `Include` whose file (or parent
+  directory) is missing is skipped. A file created later is read on the next
+  connection, and a directory at that path is ignored. A file that **exists but
+  is unreadable** makes ssh abort every connection (`Can't open user config
+  file`), so that one case is still left out, now with a warning on stderr.
+  Output is byte-identical to v1.12.0 when the file exists at start.
+  `scripts/smoke-test.sh` gains two checks: Included when created after start,
+  and left out when unreadable. Against the v1.12.0 script the first fails and
+  the second passes. README *Naming LAN peers* no longer says that creating the
+  file needs a restart.
+
 ## v1.12.0 — 2026-10-18
 
 Minor release. Headlines: **pi 1.3.0**, **mempalace 3.11.0**, **pi-atelier