[holmboe]

make deploy generated the admin's SSH key into k8s/base/ssh/ of whichever worktree deployed. Every other worktree sharing the k3d instance had no key: git over SSH did not work there, and tests/k8s/test_ssh.py and kubectl kustomize k8s/overlays/ci (in test-k8s) failed for want of the file.

What changes

• A committed, publicly known key, k8s/base/ssh/phabfive-insecure (comment phabfive-insecure), the way the API token api-supersecr3tapikeyfordevelop1 is committed. k8s/base/ssh/README.md and docs/phorge-setup.md say it is public and must never be authorized anywhere else
• ssh refuses a private key others can read, and git checks the file out 0644. So make deploy and make ssh-forward copy it to .k8s/phabfive-insecure with mode 0600 (SSH_KEY), and test_ssh.py makes its own 0600 copy in tmp_path. kustomize still reads only the .pub, in place
• make reset keeps the key and still deletes .k8s/known_hosts. make validate no longer depends on a generated key
• StrictHostKeyChecking=accept-new: make creds (the banner) now prints the whole GIT_SSH_COMMAND with it, alongside make ssh-forward and the docs, which already had it. Each make reset brings a new host key
• Existing instances need no reset. The sshkeys seed adds the new key next to the old generated one on the next start (it skips only an identical key body). The Phorge key name is now phabfive-insecure instead of phabfive-dev
• Scanners: detect-private-key excludes the one file. trufflehog 3.99.2 reports it as unverified only, and both CI and the pre-commit hook run with --results=verified,unknown, so it needs no exclusion. GitHub push protection did not block the push

Verified

• make validate passes for every overlay. make .k8s/phabfive-insecure makes a 0600 copy
• pre-commit passes on the changed files (local trufflehog aside: it isn't installed here, so I ran the container on k8s/base/ssh/, and it reported only the unverified result above)
• I did not redeploy the shared local instance: changing the secret restarts Phorge for everyone using it. The Deploy and test … in k3d job, which this PR triggers because it touches k8s/, runs test_ssh.py on a fresh cluster with the new key

🤖 Generated with Claude Code