fix(release): stream lftp commands directly (#216)

## Summary
- feed the generated lftp command script directly over stdin
- avoid reopening `/dev/stdin`, which fails on the production hosted
runner
- keep FTP credentials out of process arguments

## Verification
- `vitest run tests/unit/cpanel-deploy.spec.js` (26/26)
- ESLint on changed files
- `git diff --check`

Supersedes the failed production release run 29948809036.

scripts/release/cpanel-deploy-lib.mjs

@@ -440,7 +440,10 @@ export function createLftpTransport(config, dependencies = {}) {
 
   async function run(commands) {
     try {
-      await runner("lftp", ["-f", "/dev/stdin"], {
+      // lftp reads commands from standard input when no command source is
+      // specified. Avoid `-f /dev/stdin`: some hosted runners expose that
+      // path as a non-reopenable pipe, causing lftp's `source` command to fail.
+      await runner("lftp", [], {
         input: buildLftpScript(config, commands),
         label: "FTPS operation",
       });

tests/unit/cpanel-deploy.spec.js

@@ -247,7 +247,7 @@ describe("secure FTPS archive upload", () => {
       sha256: hash,
     });
     expect(calls).toHaveLength(2);
-    expect(calls[0].args).toEqual(["-f", "/dev/stdin"]);
+    expect(calls[0].args).toEqual([]);
     expect(calls[0].input).toContain(`${path.basename(archivePath)}.part`);
     expect(calls[0].input).toContain("get 'archives/");
     expect(calls[1].input).toContain(