integration: LAB_TEST_SSH_KEY for a dedicated passphrase-less test key

A passphrase-protected default id_rsa makes every provision test fail as
'SSH not available' with a healthy machine: BatchMode ssh silently never
offers the key without an agent, and non-interactive runs have no agent.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6HNx6cyr4J4CiMGCy1wkF

bastion/tests/integration/data-disks.test.ts

@@ -41,6 +41,18 @@ const RN = { serial: "RNDRILL7FD4070C", sizeGb: 20 };
 const PRESERVED = ["/home", "/srv", "/var/lib/longhorn", "/var/lib/rancher"];
 
 function findSshKey(): { pubKey: string; keyPath: string } {
+  // A passphrase-protected default key fails SILENTLY here: BatchMode ssh
+  // never offers it without an agent, the server logs only "Connection closed
+  // [preauth]", and the test reads as "installed machine never came up" when
+  // the machine was fine. LAB_TEST_SSH_KEY names a dedicated passphrase-less
+  // keypair and sidesteps the whole class.
+  const envKey = process.env["LAB_TEST_SSH_KEY"];
+  if (envKey) {
+    if (!existsSync(envKey) || !existsSync(`${envKey}.pub`)) {
+      throw new Error(`LAB_TEST_SSH_KEY=${envKey}: key or .pub missing`);
+    }
+    return { pubKey: readFileSync(`${envKey}.pub`, "utf-8").trim(), keyPath: envKey };
+  }
   const homes = [homedir()];
   const sudoUser = process.env["SUDO_USER"];
   if (sudoUser) homes.push(join("/home", sudoUser));