setup-lan-access: Include ssh-lan.conf even if it is created after start

The Include for ~/.config/devbox-shell/ssh-lan.conf was written only if the
file was readable at container start. A file created afterwards was visible in
the container and silently ignored. Hit on EMB-3HXGNXJ0 on 2026-10-18: the
tor-ms22 override was skipped, ssh fell through to the Mac's passphrase key,
and BatchMode got "Permission denied (publickey,...)" until the script was
rerun by hand.

The line is now always written. Measured with this image's OpenSSH 10.0p2,
expectations written before each run:
- file missing, and also its parent directory missing: Include skipped, rc 0
- file created after the config was written: read on the next ssh, no rerun
- a directory at that path: ignored, rc 0
- file present but unreadable: ssh aborts EVERY connection ("Can't open user
  config file"). So that case is still left out, now with a warning on stderr.
- world-writable file: "Bad owner or permissions". The old code Included that
  case too, so nothing changes there.
When the file exists at start, the generated config is byte-identical to
v1.12.0's. When it is absent, the only difference is the added Include block.

scripts/smoke-test.sh: two new checks, "Included even if created after start"
and "unreadable left out". Run here, the way exec_test runs them: against the
v1.12.0 script the first FAILs and the second PASSes; against this one both
PASS. README "Naming LAN peers": creating the file no longer needs a restart.
CHANGELOG: Unreleased > Fixed.

lint-shell: clean. check-doc-drift still fails, as it already did on HEAD:
pi-toolkit 3760d90->7c05901 and pi-studio 76db01f->4b4abd1 have moved upstream
since v1.12.0 and are not named in the CHANGELOG. That is release prep and is
not addressed here.

README.md

@@ -1174,12 +1174,19 @@ published image (they are a fact about your LAN, not the image). Alternatively,
 set `DEVBOX_LAN_AUTOJUMP_PRIVATE=1` to ProxyJump *any* RFC1918 address through
 the host without naming peers (see `.env.example`).
 
-Once the file exists it is re-read on every connection, so *edits* take effect
-immediately — no container or session restart. **Creating it for the first time
-does need one restart**, because `setup-lan-access.sh` only emits the
-`Include ~/.config/devbox-shell/ssh-lan.conf` line when the file is already
-readable at container start (`if [ -r "$SSH_LAN_CONF" ]`). Until then ssh never
-looks at it — which reads exactly like "my override is being ignored".
+ssh reads the file on every connection, so creating it and editing it both take
+effect immediately — no container or session restart. `setup-lan-access.sh`
+writes the `Include ~/.config/devbox-shell/ssh-lan.conf` line whether or not the
+file exists yet (ssh skips an `Include` whose file is missing). Images up to and
+including v1.12.0 wrote that line only if the file was readable at container
+start. There, a file created afterwards is ignored until a restart, or until you
+run `bash /usr/local/lib/pi-devbox/setup-lan-access.sh` in the container.
+That looks exactly like "my override is being ignored". One case still needs
+action: a file that exists but the container cannot read is left out, because
+ssh would otherwise refuse every connection. The script then prints a warning at
+start. Two other permission traps apply to this file as to any ssh config.
+ssh rejects it if it is world-writable (`Bad owner or permissions`). And on native
+Linux, the host user's uid must match the container's `developer` (1000).
 
 #### Giving the container its own key for a peer