fix(staging): rotate SSH secret handling and env ownership

docs/BUG_HISTORY.md

@@ -2208,3 +2208,19 @@
 - 相关记录：BUG-126
 - 复发自：无
 - 修复版本：本次个人报告 staging 发布提交
+
+## BUG-128 | staging deploy 泄漏多行 SSH secret 且 env owner 契约互相冲突
+
+- 状态：resolved（local，pending quality-gate rerun）
+- 首次发现：2026-08-06
+- 最近更新：2026-08-06
+- 影响面：Gitea/GitHub staging deploy 与 migration workflow、staging SSH 凭据、`.env.staging*` owner、加密备份和发布门禁；production 未受影响。
+- 用户现象：exact-SHA 自动 deploy run `1464` 在应用切换前失败；Gitea job 日志把多行 staging SSH 私钥逐行显示，同时远端数据库 env validator 报 owner 不匹配。公网仍运行旧 SHA。
+- 触发条件：Gitea workflow 将多行 OpenSSH key 直接放入 step env；root 控制脚本验证一个由 `deploy` 持有的 mode-0600 env；此前 root rollout 临时文件又通过 `mv` 把 env owner 改成 root。
+- 根因：Gitea runner 不能可靠遮蔽多行 secret 的每一行；控制面同时混用了“当前脚本用户”和“部署树 owner”作为 env ownership 事实，rollout 覆盖文件时未保留原 owner/gid。
+- 修复：立即停止发布，生成并验证新 staging ED25519 key，精确撤销旧 authorized key，证明旧 key 无法登录，删除本地旧 key，更新 Gitea/GitHub staging secrets，并删除 28 个可能含旧 key 的 Gitea deploy/migration runs。`STAGING_SSH_PRIVATE_KEY` 改为单行 base64；所有 staging workflow 解码到 0600 临时文件并用 `ssh-keygen` 验证。deploy/migration 以部署树 UID 校验两个 env；backup helper 继续以 `deploy` 运行；rollout 临时文件显式保留部署树 owner/gid。
+- 验证：新 key 严格主机校验登录成功，旧 key 登录失败；新 Gitea/GitHub secrets 已更新；泄漏 run `1464` 已删除；focused workflow、owner、shell/YAML 和 governance tests 待本次提交执行，完整 staging gate/deploy 待新 exact SHA。
+- 防复发：禁止 staging workflow 直接注入多行私钥或打印 decoded secret 变量；env owner 必须由部署树身份决定，root 受控脚本不得用 root 临时文件改变持久 env owner。任何凭据日志暴露先轮换/撤销/清理，再修代码和重跑。
+- 相关记录：BUG-124、BUG-127、ERR-092、ERR-093、ERR-094
+- 复发自：无
+- 修复版本：待安全修复 PR 与 staging 验收

docs/research/pre_work_error_ledger.md

@@ -139,6 +139,12 @@ Before the personal-report staging migration, the encrypted backup helper correc
 
 Prevention: before staging backup/migration, verify both env files are regular, non-symlink files owned by `deploy:deploy` with mode `0600`; restore only that documented owner/mode under the shared mutation lock, without printing or copying file contents. Run `backup-staging-postgres.sh` as `deploy`, never weaken its ancestor checks, never create a parallel root backup tree, and never broaden env permissions.
 
+## ERR-094 | Gitea expanded a multiline staging SSH secret in failed workflow logs | mitigated 2026-08-06
+
+A failed exact-SHA staging deploy displayed the multiline staging SSH private key in the job environment block instead of masking each line. Release mutations were stopped immediately. The staging-only key was rotated, the new key was verified before the exposed key was removed from `authorized_keys`, the old key was proven unable to authenticate and deleted locally, Gitea and GitHub staging secrets were replaced, and 28 potentially affected Gitea deploy/migration runs were deleted. The successful quality-gate run and immutable image manifest were retained because they never received the SSH secret.
+
+Prevention: store `STAGING_SSH_PRIVATE_KEY` only as one unwrapped base64 line; workflows decode it into a mode-`0600` temporary key, validate it with `ssh-keygen`, and delete the temporary directory on every exit. Contract tests must reject direct multiline `SSH_PRIVATE_KEY` injection or `printf` of a decoded secret variable. A leaked staging key must be rotated and revoked before any rerun; production keys remain a separate boundary and were not involved in this incident.
+
 ## Fragment Sweep Command Set
 
 ## ERR-086 | Steve Jobs jyotishganit artifacts used non-San-Francisco coordinates | mitigated 2026-07-21