SSH key handoff

The bootstrap (install.sh) clones a personal repo over a URL it's given, and on a keyless fresh machine falls back to an interactive keygen-and-register pause or an https:// clone (both shipped). What remains is the unattended deploy-key path and reconciling with the roles that own steady-state keys. Background: the team-fleet provisioning blog post.

Items

• Reconcile with the git/ssh roles, which already manage keys at apply time: the bootstrap only needs enough key to clone the personal repo; the roles own the steady-state key material. Decide whether the bootstrap generates a throwaway key or seeds the one the ssh role then adopts
• Tie into dotpro init: a late-commands autoinstall has no operator at the keyboard, so the unattended path needs a pre-seeded deploy key or token rather than the interactive pause. The ssh role could fetch this key from a secret store (Bitwarden, a vault) to seed an otherwise keyless fresh machine, instead of pausing for manual registration