Wush establishes a WireGuard tunnel between your local machine and a GitHub Actions runner - traffic is E2E-encrypted. It doesn't require you to trust any 3rd party authentication or relay servers, instead using x25519 keys to authenticate connections.
To run coder/wush-action regardless of whether a job succeeds or fails, consider using ${{ !cancelled() }} instead of ${{ always() }}:
always() is immune to cancellation, so you won't be able to stop wush by cancelling the workflow. Instead, you'll need to SSH into GitHub Actions and kill the wush process manually.