fix: deploy verify uses mirrored client, release revoke via Session, remote error tail

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy_hub_remote.py

@@ -55,7 +55,7 @@ class Remote:
         rc = out.channel.recv_exit_status()
         log(f"$ {cmd}\n{text.rstrip()[-1500:]}")
         if check and rc != 0:
-            raise RuntimeError(f"exit {rc}: {cmd}")
+            raise RuntimeError(f"exit {rc}: {cmd[:120]} :: {text.strip()[-400:]}")
         return text
 
     def put(self, local: Path, remote: str) -> None:
@@ -181,8 +181,8 @@ def main() -> int:
                   check=False)
             log(f"EXPECTED_SHA256={digest} SIZE={installer.stat().st_size}")
             # older Setup installers stop being offered (never deleted); the newest PUBLISHED release is the default
-            r.run(f"docker exec {HUB} python -c \"from central.app.db import engine; from sqlalchemy import text; c=engine.begin().__enter__(); "
-                  f"print('revoked', c.execute(text(\\\"update agent_releases set status='REVOKED' where status='PUBLISHED' and filename like 'GTIFiscalAgent-Setup-%.exe' and version<>'{version}'\\\")).rowcount)\"",
+            r.run(f"docker exec {HUB} python -c \"from central.app.db import engine; from sqlalchemy import text; from sqlalchemy.orm import Session; "
+                  f"s=Session(engine); n=s.execute(text(\\\"update agent_releases set status='REVOKED' where status='PUBLISHED' and filename like 'GTIFiscalAgent-Setup-%.exe' and version<>'{version}'\\\")).rowcount; s.commit(); print('revoked', n)\"",
                   check=False)
             st["stage"] = "verify_download"
             r.run(f"docker exec {HUB} python central/scripts/verify_release_download.py {version}")