Allow diagnostic SSH when persistent state is unavailable

[Deadbytes101]

Physical alpha.9 validation confirmed that firstboot diagnostics now appear when persistent state reports limited_capacity, but ssh.service remains blocked because rigos-ssh-hostkeys.service hard-requires rigos-state-ready.service.

Required behavior:

• keep SSH host identity mandatory before sshd starts
• use the persistent ED25519 host identity when verified state is ready
• otherwise generate a boot-scoped ED25519 identity only under /run/rigos
• never write fallback keys into an unverified /var/lib/rigos mount
• expose the selected host-key mode in status
• keep mining/configuration fail-closed when state is unavailable
• allow rigosadmin password SSH for remote diagnostics and test collection

Physical evidence: alpha.9 firstboot UI displayed the explicit limited_capacity diagnostic, while port 22 was refused because the host-key authority was dependency-blocked.

[Deadbytes101]

Implementation is now in draft PR #23 on fix/alpha10-diagnostic-ssh.

Current exact head: 1f2981cefff10c1d8fb1a070d454fe7065f74ed7.

Design:

• ssh.service still requires successful host identity establishment.
• rigos-ssh-hostkeys.service now wants/orders after state readiness but does not require success.
• verified state publishes the persistent ED25519 identity into /run/rigos/ssh-hostkeys;
• unavailable state generates an ephemeral boot-scoped ED25519 identity only in /run/rigos;
• sshd uses the runtime identity, allows password login only for rigosadmin, and denies root login;
• miner/configuration state gates are unchanged.

Source and exact-image gates were updated, and a behavioral fixture verifies that the unavailable-state branch does not touch persistent state. Exact-head WSL source verification has not run yet.

[Deadbytes101]

Alpha.10 source gate passed at exact head 33e02e253b9d0691909e22464d0eee34056958f6.

The new diagnostic SSH source tests passed for both host-key modes:

• unready/limited-capacity state selects an ephemeral per-boot ED25519 identity without touching persistent state
• ready verified state selects the persistent identity and publishes it to runtime

Systemd ordering and the full WSL source gate also passed. Exact image build and physical port-22 validation remain pending.

[Deadbytes101]

Alpha.10 exact-image artifact is now built and all exact-image gates passed from source head 33e02e253b9d0691909e22464d0eee34056958f6.

Artifact: rigos-usb-amd64-0.0.4-alpha.10.img
SHA256: 479ac1d66529aa4904e3556a6ba9c8fc92aff72468ea75a6c46f31cf885bdab5

Next acceptance step is physical boot on the limited-capacity test USB and confirmation that port 22 accepts rigosadmin password SSH using an ephemeral per-boot host key while configuration/mining remain blocked.

[Deadbytes101]

Physical alpha.10 evidence confirms the diagnostic SSH fix works on hardware:

• port 22 reachable
• rigosadmin password login succeeds
• rigos-ssh-hostkeys.service exits successfully
• runtime status reports persistence_mode=ephemeral
• active key lives only under /run/rigos
• state readiness, profile application, and miner remain blocked

The only remaining acceptance item for this issue is reboot validation that SSH returns and the ephemeral fingerprint rotates when persistent state is still unavailable.