v0.46.2

What's new

• chore: release v0.46.2
• docs: list push_probe in Key Files and release prerequisites
• infra: push probe, observable gate output

Details

Two observability gaps from the release nights, closed together.
tools/push_probe.sh stages what dry-run cannot: anonymous discovery
proves reachability, an authed curl of the receive-pack endpoint
proves the credential, and permissions.push proves authorization --
each timed, each named, because 'dry-run passed' once cost an evening
to a POST that never authenticated. local-ci.py line-buffers stdout so
a backgrounded run stays watchable via tail -f instead of looking dead
until it exits. Runbook records both.