fix(ssh): clean owned update staging across initialization signals #322

Observed failure

PR #321 head e8f1e7dccfd204939028bc0c4d0d39da381eee47 failed the macOS Python 3.13 core test RemoteTransfer.test_interrupted_transfer_preserves_old_installation in run 39203502096. The prior installation assertions passed, but an owned .session-peer-update.* staging directory remained and the required aggregate release gate failed.

Independently reproduced source window

The destination script creates the directory with T=$(mktemp -d ...) before registering the EXIT and signal traps. A controlled local POSIX fixture that pauses after directory creation but before returning its path reproduces an orphan when the owned process group receives SIGTERM. Merely moving the EXIT trap earlier cannot clean a directory whose path has not yet been assigned.

This demonstrates a real initialization interruption window. It does not establish the exact scheduling or root cause of the observed CI run. Transfer-phase interruption and fixture synchronization must be tested separately; the original failure log must remain available.

Required bounded fix

• Protect creation/path-ownership handoff from handled HUP/INT/TERM and preserve a pending cancellation before starting the decoder.
• Clean only the current transaction's owned staging directory; preserve unrelated sentinel data and installation/launcher bytes, modes and identities.
• Cover both initialization and actual partial-transfer interruption with controlled local fixtures, not longer sleeps or weaker assertions.
• Preserve concurrent-publication locks, rollback rules, strict receipts and unknown/no-automatic-resend policy. Do not claim cleanup after SIGKILL, host loss or arbitrary failures.
• Regenerate standalone source, run related and integrated checks, independently review the fix, and update chore(release): prepare v1.2.1 maintenance candidate #321 before rerunning current-head CI.

v1.2.1 patch candidate. No merge, tag, package publication, global installation, real SSH/agent message or operational change is authorized by this issue.