SSH key handoff (#3)

The bootstrap (install.sh) clones a personal repo over a URL it's given. On a keyless fresh machine it falls back to an https:// clone, then to an interactive keygen-and-register pause; a non-interactive run exits instead. What remains is the unattended deploy-key path and deciding which role owns the key after the bootstrap. Background: the team-fleet provisioning blog post.

Items

• Reconcile with the ssh role, which loads existing keys into keychain (ssh_keychain_keys) and writes host aliases but generates or fetches no key material: the bootstrap only needs enough key to clone the personal repo. Decide whether the bootstrap generates a throwaway key or seeds the one the ssh role then adopts
• Tie into dotpro init: a late-commands autoinstall has no operator at the keyboard, so the unattended path needs a pre-seeded deploy key or token rather than the interactive pause. The ssh role could fetch this key from a secret store (Bitwarden, a vault) to seed an otherwise keyless fresh machine, instead of pausing for manual registration