add self-healing root SSH key systemd units

Headless Pis lose /root/.ssh/authorized_keys to imaging, first-boot tooling,
or config management, which locks out the only SSH account that can fix it.

- ensure-root-ssh-key: idempotent POSIX sh installer. Appends managed public
  keys from /usr/local/share/root-ssh-keys/authorized_keys, never removes or
  rewrites foreign keys, skips lines whose first field is not a known key
  algorithm, and enforces 0700 / 0600 root:root on the key dir and file.
- ensure-root-ssh-key.service: oneshot, ordered Before=ssh.service so the key
  lands before the daemon starts; ConditionPathExists skips it when the
  managed keys file is absent.
- ensure-root-ssh-key.path: PathChanged= + PathModified= on authorized_keys so
  deletes, renames, and in-place edits are healed at runtime, not just at boot.
  Writes only when a key is missing, so the unit settles after one no-op run.
- authorized_keys.example: template with commented placeholder keys only; the
  real file stays on the host.
- root-ssh-key.md: runbook with deploy, verification, revocation steps, and
  the gotcha that systemd has no PathMissing= key.

LLM-Generated: true

active/device_raspberry_pi/systemd/ensure-root-ssh-key.service

@@ -0,0 +1,15 @@
+[Unit]
+Description=Ensure managed SSH public keys are installed in /root/.ssh/authorized_keys
+Documentation=man:sshd(8)
+After=local-fs.target
+Before=ssh.service sshd.service
+ConditionPathExists=/usr/local/share/root-ssh-keys/authorized_keys
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/ensure-root-ssh-key
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target