setup-lan-access: Include ssh-lan.conf even if it is created after start

The Include for ~/.config/devbox-shell/ssh-lan.conf was written only if the
file was readable at container start. A file created afterwards was visible in
the container and silently ignored. Hit on EMB-3HXGNXJ0 on 2026-10-18: the
tor-ms22 override was skipped, ssh fell through to the Mac's passphrase key,
and BatchMode got "Permission denied (publickey,...)" until the script was
rerun by hand.

The line is now always written. Measured with this image's OpenSSH 10.0p2,
expectations written before each run:
- file missing, and also its parent directory missing: Include skipped, rc 0
- file created after the config was written: read on the next ssh, no rerun
- a directory at that path: ignored, rc 0
- file present but unreadable: ssh aborts EVERY connection ("Can't open user
  config file"). So that case is still left out, now with a warning on stderr.
- world-writable file: "Bad owner or permissions". The old code Included that
  case too, so nothing changes there.
When the file exists at start, the generated config is byte-identical to
v1.12.0's. When it is absent, the only difference is the added Include block.

scripts/smoke-test.sh: two new checks, "Included even if created after start"
and "unreadable left out". Run here, the way exec_test runs them: against the
v1.12.0 script the first FAILs and the second PASSes; against this one both
PASS. README "Naming LAN peers": creating the file no longer needs a restart.
CHANGELOG: Unreleased > Fixed.

lint-shell: clean. check-doc-drift still fails, as it already did on HEAD:
pi-toolkit 3760d90->7c05901 and pi-studio 76db01f->4b4abd1 have moved upstream
since v1.12.0 and are not named in the CHANGELOG. That is release prep and is
not addressed here.

rootfs/usr/local/lib/pi-devbox/setup-lan-access.sh

@@ -51,8 +51,8 @@
 # HOST-OWNED PEER POLICY (portable; keeps this image generic)
 #   Named LAN peers are facts about a *specific* host's network, not about the
 #   image — a roaming laptop sees different LANs. So we never bake peer names
-#   here. Instead, if the host bind-mounts ~/.config/devbox-shell/ssh-lan.conf
-#   (the same devbox-shell bridge dir used for shared aliases), we Include it
+#   here. Instead we Include ~/.config/devbox-shell/ssh-lan.conf (the host
+#   bind-mounts the devbox-shell bridge dir, also used for shared aliases)
 #   *before* ~/.ssh/config. That file holds the host's own jump overrides, e.g.
 #       Host pve pve-2 pbs-vm
 #           ProxyJump host
@@ -151,8 +151,22 @@ EOF
 
   # Optional host-owned named-peer jump overrides (portable: lives on the host,
   # not in the image). Included BEFORE ~/.ssh/config so its ProxyJump wins.
+  #
+  # Included even when the file does not exist yet. ssh skips an Include whose
+  # file is missing, and reads it on the next connection once it appears.
+  # Through v1.12.0 the Include was written only if the file was readable at
+  # container start. A file created later was then visible in the container but
+  # ignored, until a restart (EMB-3HXGNXJ0, 2026-10-18: its tor-ms22 override
+  # was skipped, so ssh fell back to a passphrase key and BatchMode failed).
+  # Only a file that EXISTS but cannot be read is left out. ssh aborts every
+  # connection on one ("Can't open user config file"), which would break all
+  # ssh, git included. A directory at that path is harmless (ssh ignores it).
+  # Measured with this image's OpenSSH 10.0p2; scripts/smoke-test.sh checks
+  # both cases.
   SSH_LAN_CONF="${HOME}/.config/devbox-shell/ssh-lan.conf"
-  if [ -r "$SSH_LAN_CONF" ]; then
+  if [ -e "$SSH_LAN_CONF" ] && [ ! -r "$SSH_LAN_CONF" ]; then
+    echo "setup-lan-access: $SSH_LAN_CONF exists but is not readable, so it is not Included (ssh would refuse every connection). Fix its permissions, then rerun this script or restart the container." >&2
+  else
     LAN_CONF_BLOCK=$(cat <<'EOF'
 
 # Host-owned named-peer jump overrides (bind-mounted; edit on the host).