fix(build-and-push): hard-timeout the SSH probe so it can't hang

ConnectTimeout only bounds the TCP handshake; wrap ssh in a 25s timeout
plus keepalives so a firewall that accepts SYN then drops packets fails
fast with a clear diagnostic instead of hanging the runner.

.gitea/workflows/test-build.yaml

@@ -1,9 +1,5 @@
 name: Test build-and-push (self-test)
 
-# Validates the build-and-push composite action end-to-end against the remote
-# docker-build.haven buildx builder, using a tiny throwaway image. Runs on
-# manual dispatch and whenever the action itself changes.
-
 on:
   workflow_dispatch: {}
   push:
@@ -14,8 +10,6 @@ on:
       - .gitea/workflows/test-build.yaml
 
 env:
-  # Throwaway image ref — kept separate from any real project image so this
-  # self-test can never clobber a production tag.
   IMAGE: git.ivanch.me/ivanch/pipeline-actions-selftest
 
 jobs: