ci: support Windows SSH credential binding

Jenkinsfile

@@ -220,7 +220,10 @@ print('versions.json updated, platformVersion=' + d.get('platformVersion', ''))
             git diff --cached --quiet || git commit -m "ci: bump versions [${summary}] [skip ci]"
           """
           // push 加 retry + rebase，应对多 job 并发推送冲突
-          sshagent(credentials: ['jenkins-ssh-key']) {
+          withCredentials([sshUserPrivateKey(credentialsId: 'jenkins-ssh-key', keyFileVariable: 'GIT_SSH_KEY')]) {
+            writeFile file: 'git-ssh.cmd', text: '@echo off\r\nssh -i "%GIT_SSH_KEY%" -o IdentitiesOnly=yes %*\r\n', encoding: 'UTF-8'
+            try {
+              withEnv(["GIT_SSH=${pwd()}\\git-ssh.cmd"]) {
                 retry(3) {
                   bat """
                     chcp 65001 >nul
@@ -229,6 +232,10 @@ print('versions.json updated, platformVersion=' + d.get('platformVersion', ''))
                   """
                 }
               }
+            } finally {
+              bat 'if exist git-ssh.cmd del /f /q git-ssh.cmd'
+            }
+          }
         }
       }
     }

README.md

@@ -541,3 +541,8 @@ update:
 tenant-service 与 update-service 必须由部署平台注入同一份非空
 `SDK_INTERNAL_TOKEN`。缺失或仍为历史占位值时，应用归属校验和发布清单签名会在请求前
 关闭；令牌不得写入仓库、构建日志或安装包。
+
+### Jenkins SSH
+
+Windows Jenkins 节点通过 `jenkins-ssh-key` 私钥凭据生成构建期临时
+`git-ssh.cmd` 执行版本拉取与推送，作用域结束后立即删除该脚本。