ci: support Windows SSH credential binding

Jenkinsfile

@@ -220,13 +220,20 @@ print('versions.json updated, platformVersion=' + d.get('platformVersion', ''))
             git diff --cached --quiet || git commit -m "ci: bump versions [${summary}] [skip ci]"
           """
           // push 加 retry + rebase，应对多 job 并发推送冲突
-          sshagent(credentials: ['jenkins-ssh-key']) {
-            retry(3) {
-              bat """
-                chcp 65001 >nul
-                git pull --rebase origin main
-                git push origin HEAD:main
-              """
+          withCredentials([sshUserPrivateKey(credentialsId: 'jenkins-ssh-key', keyFileVariable: 'GIT_SSH_KEY')]) {
+            writeFile file: 'git-ssh.cmd', text: '@echo off\r\nssh -i "%GIT_SSH_KEY%" -o IdentitiesOnly=yes %*\r\n', encoding: 'UTF-8'
+            try {
+              withEnv(["GIT_SSH=${pwd()}\\git-ssh.cmd"]) {
+                retry(3) {
+                  bat """
+                    chcp 65001 >nul
+                    git pull --rebase origin main
+                    git push origin HEAD:main
+                  """
+                }
+              }
+            } finally {
+              bat 'if exist git-ssh.cmd del /f /q git-ssh.cmd'
             }
           }
         }

README.md

@@ -541,3 +541,8 @@ update:
 tenant-service 与 update-service 必须由部署平台注入同一份非空
 `SDK_INTERNAL_TOKEN`。缺失或仍为历史占位值时，应用归属校验和发布清单签名会在请求前
 关闭；令牌不得写入仓库、构建日志或安装包。
+
+### Jenkins SSH
+
+Windows Jenkins 节点通过 `jenkins-ssh-key` 私钥凭据生成构建期临时
+`git-ssh.cmd` 执行版本拉取与推送，作用域结束后立即删除该脚本。