Moved SSH cred removal to last step

Just in case $TEST_CMD needs it, for example to clone more private repos.
Also check that $APP_DIR was really created, and fail more gracefully