Attach operator keys to builders so none gets an emailed root password

The controller created every builder without a DigitalOcean account key, so
DigitalOcean set a root password, emailed it to the token's owner, and turned
password logins on: one email and one password-reachable box per builder,
146 of them on Oct 8.

DO_SSH_KEYS lists account key IDs attached at creation (Ryan, DHH and Emir
in the template). It needs ssh_key:read on the controller's token; without it
every create is refused with 403, so it stays empty until the token has it.
Builders also turn password SSH off in cloud-init, which holds even while no
account key is attached, and Emir joins the operators whose GitHub keys reach
root.

ci/controller-box/controller.env.example

@@ -17,3 +17,8 @@ LOCK=/run/omarchy-controller/lock
 # Operator public keys for root on every builder droplet (JSON array).
 # create.sh fills this from the operators' GitHub keys.
 SSH_KEYS_JSON=[]
+# DigitalOcean account SSH key IDs attached to every builder (JSON array), so
+# DigitalOcean does not email a root password for each one. Needs ssh_key:read
+# on DIGITALOCEAN_TOKEN. List them with: doctl compute ssh-key list
+# Ryan R. Hughes, DHH, Emir.
+DO_SSH_KEYS=[59143572,59143588,59779105]

ci/controller-box/create.sh

@@ -18,7 +18,7 @@ SSH_KEYS=${SSH_KEYS:-[]}
 # Public keys authorized for root: the operators' GitHub keys, fetched at
 # creation so the box never depends on an ssh_key API scope. Override with
 # ADMIN_GITHUB_USERS.
-ADMIN_GITHUB_USERS=${ADMIN_GITHUB_USERS:-ryanrhughes dhh}
+ADMIN_GITHUB_USERS=${ADMIN_GITHUB_USERS:-ryanrhughes dhh emirb}
 ssh_keys_json=$(for u in $ADMIN_GITHUB_USERS; do curl -fsS "https://github.com/$u.keys"; done | jq -R . | jq -sc .)
 [[ $(jq length <<<"$ssh_keys_json") -gt 0 ]] || { echo "no ssh keys fetched for $ADMIN_GITHUB_USERS" >&2; exit 1; }