Idempotent role: install fleet User CA public key + TrustedUserCAKeys drop-in, validate sshd -t, reload. Sectestbed wave first, prod under CR. https://projects.knownelement.com/issues/385
check-rules green; shellcheck fixes to dpkg.sh/os-updates.sh (legacy backticks, unquoted vars, array-quoted command builders); Discourse pointers added to basis docs; awx/k8s/compliance repos referenced. https://projects.knownelement.com/issues/454