Charter v66: release branches are held as main is, and a push outlasts long checks over ssh

• A release branch is held as main is (#441, reported by another project's CTO from its
  QA's finding; #446; and #450, found by QA in its review of PR #449). That project ships fixes
  from a release branch while main carries its next release, and the pre-push gate let a direct
  push to that branch through, since it held the default branch alone. §2.3: a project lists the
  patterns of its release branches in .agent-squad-release-branches, at its root, in the form of
  .agent-squad-checks. Only a PR reviewed by QA changes a branch that matches, with the same
  exception as main. The pre-push gate refuses a direct push to one, and reads the declaration
  from the default branch's tip, so that a push cannot lift it with its own commit. A push by URL
  is held as one by the name of the remote whose URL or push URL it is, for the default branch as
  for a release branch. A fix goes to main first, and a backport, a PR that names the PR it
  carries (Backport of #M), takes it to the release branch: §2.4, §3, §4.1, §4.2, §5 and §6 say
  so. BOOTSTRAP's row 6 protects the release branches on GitHub, and templates/AGENTS.md
  records them.
• A push whose checks take minutes reaches the remote over ssh (#438, found by DEV on PR
  #436). git push opens its ssh connection before the pre-push checks run. On 2026-10-18 the
  connection was closed while it sat idle through 7 minutes of checks, so the push died of a
  broken pipe once they had passed. The installer now sets core.sshCommand to
  ssh -o ServerAliveInterval=30 in the project's own .git/config. It leaves alone a
  core.sshCommand that the project or the machine has set already, and a GIT_SSH, which it
  would override. --check has an item for it, and the uninstaller removes it. After checks that
  ran longer than SQUAD_LONG_CHECKS seconds, 120 by default, the gate's last line says that a
  broken pipe from git then means the connection closed while they ran, and that the push should
  be made again. With the keepalive, a push came through an 8-minute hook; without it, it died at
  482 s.
• Upgrading from v65: the installer sets the keepalive itself, and says so. A project with
  release branches lists them in .agent-squad-release-branches and commits the file to main
  through a PR. It also protects them on GitHub as it protects main (BOOTSTRAP.md, row 6), and
  records them in AGENTS.md. A project without release branches has nothing to do by hand. Then
  restart the three sessions, since §1, §2.3, §2.4, §3, §4, §5 and §6 change.