pub fn ensure_managed_key(config_dir: &Path) -> Result<String>Expand description
Ensure the managed ed25519 keypair exists; generate it on demand via
ssh-keygen if absent. Returns the PUBLIC key line (one line, no trailing
newline). The private key NEVER leaves disk and is never printed.