Prevent Lightsail SSH certificate expiry during deployments

[crohr]

Summary

• record the expiration returned with Lightsail SSH access details
• replace expiring AWS credentials with a run-scoped Ed25519 key after initial SSH readiness
• enforce a 12-hour server-side expiry and remove the key best-effort when deployment finishes
• rebuild the bundled Linux amd64 action binary

Validation

• make test
• mise exec -- go test ./...
• mise exec -- go test -race ./internal/pullpreview ./internal/providers/lightsail
• mise exec -- go vet ./...
• upx -t dist/pullpreview-linux-amd64
• clean GPT-5.6-sol xhigh adversarial review

Closes #138

[crohr]

@codex review