fix(TST-25,SEC): stop CI SSH key leaking in cleartext CI logs

The windows-x86 acceptance check 'no key material in logs' failed: run #37's
job log printed the full WINDEV_SSH_KEY PEM in the step env echo. Gitea's
secret masker is line-oriented, so a multiline PEM rendered as one line with
literal \n escapes never matches the real-newline secret value and is not
redacted.

Fix: store WINDEV_SSH_KEY base64-encoded (single line) so the masker redacts
it to ***; run-windev-ci.sh auto-decodes a base64 PEM (still accepts a raw PEM
for local hand-testing). Drop the redundant WINDEV_SSH_KNOWN_HOSTS from the job
env (host keys are public and come from the committed windev.known_hosts pin),
removing another cleartext env line. Document the base64 requirement in the
bring-up README.

Operationally: the previously-exposed CI key has been rotated on windev
(old pubkey revoked from administrators_authorized_keys, new key installed) and
the Gitea WINDEV_SSH_KEY secret replaced with the new key's base64.

.gitea/workflows/ci.yml

@@ -136,8 +136,11 @@ jobs:
       - uses: actions/checkout@v4
       - name: Worker x86 build + tests on windev
         env:
+          # WINDEV_SSH_KEY is stored base64-encoded (single line) so Gitea's line-oriented secret
+          # masker redacts it in the step env echo; run-windev-ci.sh decodes it. A raw multiline PEM
+          # would leak in cleartext here (TST-25 acceptance: no key material in logs). Known-hosts is
+          # public and comes from the committed scripts/ci/windev.known_hosts pin (no secret needed).
           WINDEV_SSH_KEY: ${{ secrets.WINDEV_SSH_KEY }}
-          WINDEV_SSH_KNOWN_HOSTS: ${{ secrets.WINDEV_SSH_KNOWN_HOSTS }}
           WINDEV_SSH_USER: ${{ vars.WINDEV_SSH_USER }}
           CI_SHA: ${{ github.sha }}
         # `test` = x86 build + Worker.Tests (~50s measured on windev). Demote to `build` only if the
@@ -155,8 +158,11 @@ jobs:
       - uses: actions/checkout@v4
       - name: Full Worker.Tests + live-MXAccess smoke on windev
         env:
+          # WINDEV_SSH_KEY is stored base64-encoded (single line) so Gitea's line-oriented secret
+          # masker redacts it in the step env echo; run-windev-ci.sh decodes it. A raw multiline PEM
+          # would leak in cleartext here (TST-25 acceptance: no key material in logs). Known-hosts is
+          # public and comes from the committed scripts/ci/windev.known_hosts pin (no secret needed).
           WINDEV_SSH_KEY: ${{ secrets.WINDEV_SSH_KEY }}
-          WINDEV_SSH_KNOWN_HOSTS: ${{ secrets.WINDEV_SSH_KNOWN_HOSTS }}
           WINDEV_SSH_USER: ${{ vars.WINDEV_SSH_USER }}
           CI_SHA: ${{ github.sha }}
         run: ./scripts/ci/run-windev-ci.sh live