pub fn install_authorized_key(device: &str, pubkey: &str) -> Result<()>Expand description
Install (or replace) pubkey in a marked block for device in
authorized_keys. Idempotent: a re-grant replaces that device’s block rather
than appending a duplicate. Creates ~/.ssh (0700) and the file (0600) if
absent. SECURITY: the caller MUST have verified the trusted channel + shell
cap before calling this. The pubkey is re-validated here (M-3), defense in
depth, so a bad key is NEVER written even if a caller forgot to check.