fix: preserve canary release stdin across edge checks

scripts/release-portal-canary-prod.sh

@@ -261,7 +261,9 @@ candidate_healthy() {
 }
 
 edge_ssh() {
-  ssh -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" "$@"
+  # This remote release script itself arrives on stdin. Ordinary nested SSH
+  # commands must not consume the unparsed remainder of that script.
+  ssh -n -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" "$@"
 }
 
 write_canary_tunnel_plist() {
@@ -586,7 +588,9 @@ done
 [[ "${counts:-unknown unknown}" == "0 0" ]]
 
 say "Switch the committed 105 nginx upstreams to the isolated canary tunnel"
-edge_ssh /bin/bash <<EDGE_SWITCH
+# Unlike ordinary edge_ssh calls, this command intentionally receives only the
+# bounded EDGE_SWITCH heredoc on stdin.
+ssh -o BatchMode=yes -o ConnectTimeout=10 "${EDGE_HOST}" /bin/bash <<EDGE_SWITCH
 set -euo pipefail
 for config in '${EDGE_MOBILE_CONFIG}' '${EDGE_WECHAT_CONFIG}'; do
   before_count="\$(grep -cF 'proxy_pass http://58.38.22.103:8081;' "\${config}")"