[#385] ssh_ca role + onboarding playbook (fleet SSH cert CA rollout)

Idempotent role: install fleet User CA public key + TrustedUserCAKeys
drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR.
https://projects.knownelement.com/issues/385

.crush/active-ticket

@@ -1 +1 @@
-#454
+#385

playbooks/ssh_ca_onboard.yml

@@ -0,0 +1,8 @@
+---
+# ssh_ca_onboard.yml — fleet SSH certificate CA rollout [#385]
+# Targets: sectestbed wave first (compliance lab #379), then prod under CR.
+- name: Onboard hosts to the fleet SSH certificate CA
+  hosts: all
+  gather_facts: false
+  roles:
+    - ssh_ca

roles/ssh_ca/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+# ssh_ca role defaults [#385]
+ssh_ca_key_src: fleet_user_ca.pub          # role file (public key only)
+ssh_ca_key_dest: /etc/ssh/fleet_user_ca.pub
+ssh_ca_dropin: /etc/ssh/sshd_config.d/99-fleet-ca.conf
+ssh_ca_trusted_line: "TrustedUserCAKeys /etc/ssh/fleet_user_ca.pub"

roles/ssh_ca/files/fleet_user_ca.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHtlhPfNlm/6bJqPRQv7jsrt1sMUTKgAAwUh0yZCESNU KNEL Fleet SSH User CA

roles/ssh_ca/meta/main.yml

@@ -0,0 +1,12 @@
+---
+galaxy_info:
+  author: KNEL OAM lane
+  description: Onboard host to the fleet SSH certificate CA (TrustedUserCAKeys)
+  license: AGPL-3.0-or-later
+  min_ansible_version: "2.14"
+  platforms:
+    - name: Debian
+      versions: [bookworm, trixie]
+    - name: Ubuntu
+      versions: [noble]
+dependencies: []

roles/ssh_ca/tasks/main.yml

@@ -0,0 +1,25 @@
+---
+# ssh_ca — onboard a host to the fleet SSH certificate CA [#385]
+# Idempotent: installs the public User CA + TrustedUserCAKeys drop-in.
+# Private CA keys NEVER come from the control node.
+- name: install fleet user CA public key
+  ansible.builtin.copy:
+    src: "{{ ssh_ca_key_src }}"
+    dest: "{{ ssh_ca_key_dest }}"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: install TrustedUserCAKeys drop-in
+  ansible.builtin.copy:
+    dest: "{{ ssh_ca_dropin }}"
+    content: "{{ ssh_ca_trusted_line }}\n"
+    owner: root
+    group: root
+    mode: "0644"
+  notify: reload sshd
+
+- name: validate sshd config
+  ansible.builtin.command: sshd -t
+  changed_when: false