fix(shell): sync authorized_keys with active SSH public key

[konard]

Summary

• Fixes SSH Permission denied (publickey) caused by stale authorized_keys not matching the active SSH key on the host machine
• When the managed authorized_keys file already exists, the fix now detects the active SSH private key, finds its matching .pub file, and appends the current public key if it is missing
• Adds a test verifying that a stale authorized_keys gets the current public key appended

Root cause

The ensureAuthorizedKeys function previously skipped any update when the target authorized_keys file already existed (state === "exists" → early return). If the file contained a key from a different machine or an old key, the container's sshd would reject connections because the mounted authorized_keys did not include the host's current public key.

Changes

• packages/lib/src/usecases/actions/prepare-files.ts: Modified ensureAuthorizedKeys to:
  1. Find the active SSH private key via findSshPrivateKey and check for its .pub counterpart
  2. Prefer the matching public key as the source over the general findAuthorizedKeysSource fallback
  3. Read the source key contents and skip if empty
  4. When the file already exists at the managed default path, read current contents and append the desired key if not already present
• packages/lib/tests/usecases/prepare-files.test.ts: Added test "appends the active public key to the managed authorized_keys file" that sets up a stale key, a fresh SSH keypair, and verifies both keys appear in the result

Test plan

• pnpm --filter ./packages/lib typecheck passes
• pnpm --filter ./packages/lib test passes (81 tests, including the new one)
• pnpm run check passes

Closes #155

🤖 Generated with Claude Code

[konard]

🤖 Solution Draft Log

This log file contains the complete execution trace of the AI solution draft process.

💰 Cost estimation:

• Public pricing estimate: $3.834965
• Calculated by Anthropic: $2.367758 USD
• Difference: $-1.467206 (-38.26%)

🤖 Models used:

• Tool: Claude
• Requested: opus
• Main model: Claude Opus 4.6 (ID: claude-opus-4-6, Anthropic, cutoff: 2025-05)
  📎 Log file uploaded as Gist (1191KB)
  🔗 View complete solution draft log

---

Now working session is ended, feel free to review and add any feedback on the solution draft.

[konard]

✅ Ready to merge

This pull request is now ready to be merged:

• All CI checks have passed
• No merge conflicts
• No pending changes

---

Monitored by hive-mind with --auto-restart-until-mergeable flag