fix(ssh): auto-repair stale pub that does not pair with local priv

[AhmedTMM]

Summary

Fixes the silent-failure mode reported in Slack where spawn registered a local .pub with DigitalOcean, the droplet booted with that key in authorized_keys, and SSH then failed with Permission denied (publickey) 33 times because the local .priv didn't actually pair with the registered .pub.

Adds two exported helpers in shared/ssh-keys.ts:

1. verifyKeyPair(priv, pub) — derives the pub from the priv via ssh-keygen -y -P "" -f <priv> and compares key-type + base64 (ignoring comment). Returns "match" | "mismatch" | "unverifiable".
2. repairPubFromPriv(priv, pub) — on mismatch, backs up the stale .pub to <pub>.spawn-backup-<timestamp> and rewrites .pub from the derived key. The .priv is authoritative — any .pub that doesn't derive from it is wrong by definition, so the rewrite is safe.

discoverSshKeys() now runs verify-then-repair on every pair. Passphrase-protected / otherwise unverifiable keys are skipped silently — BatchMode SSH can't use them anyway without an active ssh-agent.

Bumps CLI to 1.0.38.

Before / After (for the Slack user)

Before:

SSH key 'id_ed25519' already registered with DigitalOcean
Waiting for SSH handshake...
SSH handshake failed (1/33): Permission denied (publickey).
SSH handshake failed (2/33): Permission denied (publickey).
... 31 more ...

After:

Repaired ~/.ssh/id_ed25519.pub (stale public key replaced; original saved as ~/.ssh/id_ed25519.pub.spawn-backup-1778111358881).
Using 1 SSH key(s)
SSH handshake succeeded

The orphan stale pub that was previously registered with DigitalOcean stays on the account but is unused. The user can delete it from the DO dashboard if they want.

How the original failure happens

1. User has ~/.ssh/id_ed25519 (priv A) and ~/.ssh/id_ed25519.pub (pub B from a different machine, e.g. copied without the matching priv).
2. ensureSshKey() fingerprints .pub (B), finds it on DO, logs "already registered."
3. createServer() attaches all account keys to the droplet, including B.
4. ssh -i id_ed25519 root@droplet → priv A presents pub A to the server, server only knows B → publickey denied.

With this PR, step 1 detects the mismatch, rewrites the local .pub from priv A (now correct pub A is on disk), and registration proceeds with the correct pub.

Test plan

• bun test src/__tests__/ssh-keys.test.ts src/__tests__/ssh-keys-cov.test.ts — 29/29 pass
• bunx @biomejs/biome check src/ — clean (0 errors across 202 files)
• Auto-repair rewrites .pub with derived contents and preserves stale contents in a backup
• Passphrase-protected keys continue to be skipped silently (no backup file created)
• verifyKeyPair still returns "match" | "mismatch" | "unverifiable" (no signature change)

Closes #3396.

[la14-1]

Confirmed in the wild: this PR fixes the exact failure reported in Slack (thread) where a user hit SSH key 'id_ed25519' already registered with DigitalOcean followed by 33× Permission denied (publickey) when launching hermes. The local .pub was registered with DO (visible in their dashboard) but didn't pair with the local .priv — precisely the silent-failure mode verifyKeyPair() catches before any droplet is created.

Linked from Slack by SPA

[la14-1]

Follow-up filed: #3396 to extend this from diagnose → auto-repair (rewrite the stale .pub from the matching .priv, with backup). The current PR is a clean diagnosis layer and should merge as-is; the repair step lands on top.

The Slack user who prompted this (thread) wouldn't be unblocked by diagnosis alone — they'd still have to run ssh-keygen -y -P "" -f ~/.ssh/id_ed25519 > ~/.ssh/id_ed25519.pub manually. #3396 makes spawn do that itself so the next hermes launch Just Works.

Linked from Slack by SPA

[la14-1]

Pushed commit 2a53420 extending this from diagnose to auto-repair:

• New exported repairPubFromPriv(priv, pub) helper: on mismatch, backs up the stale .pub to <pub>.spawn-backup-<timestamp> and rewrites .pub from the derived key.
• discoverSshKeys() now calls verify-then-repair instead of warn-and-skip. The Slack user's run would now succeed end-to-end instead of needing manual ssh-keygen -y recovery.
• Extracted a private derivePubFromPriv helper so verifyKeyPair and repairPubFromPriv share the derivation (no double-invocation of ssh-keygen).
• 29/29 tests pass (was 27; added auto-repair integration test + 2 repairPubFromPriv unit tests). Biome clean on full src/.
• Bumped CLI to 1.0.38.
• Title + body updated to reflect the broader scope. Closed [Bug]: auto-repair stale .pub instead of skipping when it doesn't pair with local .priv #3396 as rolled-in.

Ready for re-review.

Updated from Slack by SPA

[la14-1]

LGTM — fixes the Slack-reported hermes launch failure end-to-end. Verify + auto-repair logic is tasteful (priv is authoritative, stale pub backed up with timestamp, passphrase keys silently skipped). Tests 29/29 and biome clean.