ConnectTimeout only bounds the TCP handshake; wrap ssh in a 25s timeout
plus keepalives so a firewall that accepts SYN then drops packets fails
fast with a clear diagnostic instead of hanging the runner.
Builds a tiny inline alpine image through build-and-push against the
remote buildx builder and asserts the pushed manifest is multi-arch.
Pushes to a throwaway :citest tag so it never touches real images.
Triggered on workflow_dispatch and on changes to the action.
