fix(release): support validated per-run SSH address family

tools/release/govoplan_release/git_state.py

@@ -197,6 +197,13 @@ def sanitized_git_environment(
     """Keep only deliberate process/auth inputs and neutralize Git redirection."""
 
     environment = os.environ if source is None else source
+    address_family = environment.get("GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY")
+    if "GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY" in environment and address_family not in (
+        "any", "inet", "inet6",
+    ):
+        raise ValueError(
+            "GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY must be any, inet, or inet6"
+        )
     result = {
         key: environment[key]
         for key in (
@@ -221,6 +228,10 @@ def sanitized_git_environment(
             "PATH": "/usr/bin:/bin",
         }
     )
+    if address_family is not None:
+        result["GIT_SSH_COMMAND"] += f" -o AddressFamily={address_family}"
+        # Preserve only an explicit, validated choice across re-sanitization.
+        result["GOVOPLAN_RELEASE_SSH_ADDRESS_FAMILY"] = address_family
     return result