Inject runner-absolute SSH opts via deploy-rs --ssh-opts

The gitea-runner is a systemd DynamicUser whose passwd home is /, so ssh
expands ~ to /.ssh/... (not $HOME). deploy-rs passes ssh opts to ssh with
no shell, so a tilde in deploy.nix sshOpts resolved to a missing key and
nix copy failed with 'failed to start SSH connection'.

Keep deploy.nix sshOpts path-free; build absolute -i/known_hosts paths in
deploy.yml from $HOME (bash-expanded) and append them via --ssh-opts, which
deploy-rs merges into NIX_SSHOPTS for the copy and the activation ssh.
Also removes the temporary SSH debug step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nix/deploy.nix

@@ -12,14 +12,15 @@ let
   };
 in
 {
-  # The Gitea runner has a global `Host * IdentityFile ~/.ssh/larsnolden` in its
-  # ~/.ssh/config (a passphrase-locked key). `-F none` makes ssh ignore that
-  # config so it doesn't offer the wrong key; `-i` + IdentitiesOnly pins the
-  # dedicated deploy key the workflow installs. Applies to both `nix copy` and
-  # the activation SSH.
+  # Path-free ssh options only. The key path and known_hosts are runner-specific
+  # and injected by the deploy.yml via deploy-rs `--ssh-opts` (which appends to
+  # this list for both `nix copy` and the activation SSH). They must be absolute:
+  # the gitea-runner is a systemd DynamicUser whose passwd home is `/`, so ssh
+  # expands `~` to `/.ssh/...` (NOT $HOME) and a tilde here finds no key. The
+  # workflow builds the absolute paths from $HOME, where bash expands correctly.
+  # `-F none` ignores the runner's ~/.ssh/config; IdentitiesOnly pins the key.
   sshOpts = [
     "-F" "none"
-    "-i" "~/.ssh/gebos_deploy"
     "-o" "IdentitiesOnly=yes"
     "-o" "StrictHostKeyChecking=accept-new"
   ];