Attach operator keys to builders so none gets an emailed root password

The controller created every builder without a DigitalOcean account key, so
DigitalOcean set a root password, emailed it to the token's owner, and turned
password logins on: one email and one password-reachable box per builder,
146 of them on Oct 8.

DO_SSH_KEYS lists account key IDs attached at creation (Ryan, DHH and Emir
in the template). It needs ssh_key:read on the controller's token; without it
every create is refused with 403, so it stays empty until the token has it.
Builders also turn password SSH off in cloud-init, which holds even while no
account key is attached, and Emir joins the operators whose GitHub keys reach
root.

ci/runner-cloud-init.yaml

@@ -14,7 +14,10 @@
 
 # Operators can reach a builder by key while it lives; it powers off after
 # one job anyway. Keys are substituted by the controller (__SSH_KEYS_JSON__).
+# Never by password: DigitalOcean sets and emails one when no account key is
+# attached, and its vendor data turns password logins on to match.
 disable_root: false
+ssh_pwauth: false
 chpasswd:
   expire: false
 ssh_authorized_keys: __SSH_KEYS_JSON__