Deploy over pinned, single-purpose keys from GitHub-hosted runners (#51)

- ops: deploy scripts the CI keys are pinned to
- ci: deploy over pinned, single-purpose keys from GitHub-hosted runners
- ops: tell shellcheck the test's variables are read through eval

ops/host/pwap-supabase-ssh

@@ -0,0 +1,17 @@
+#!/bin/bash
+# Forced command for the pwap Supabase deploy key, installed root-owned at
+# /usr/local/sbin/pwap-supabase-ssh:
+#
+#   restrict,command="/usr/local/sbin/pwap-supabase-ssh" ssh-ed25519 ...
+#
+# CI runs `ssh supabase-deploy@<host> deploy < supabase-deploy.tgz`. The
+# bundle on stdin is the only input; pwap-supabase-deploy, which sudo lets
+# this user run and nothing else, does the work.
+set -euo pipefail
+
+if [ "${SSH_ORIGINAL_COMMAND:-}" != "deploy" ]; then
+  echo "pwap-supabase-ssh: the only command is 'deploy', with the bundle on stdin" >&2
+  exit 2
+fi
+
+exec sudo -n /usr/local/sbin/pwap-supabase-deploy