preprod-cloudron runs Ubuntu-derived Cloudron OS where the unit is ssh, not sshd. Both reload paths fire under one listen keyword; failures are non-fatal (config already validated by sshd -t). https://projects.knownelement.com/issues/385
https://projects.knownelement.com/issues/385
Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385