feat: distribute Hero SSH identity

[xnoto]

Summary

Distribute the existing owner-designated encrypted SSH identity from tfroot-github to hero-host-config under the two exact secret names consumed by its manual check-only workflow:

• HERO_HOST_CONFIG_SSH_PRIVATE_KEY
• HERO_HOST_CONFIG_SSH_KNOWN_HOSTS

The source fields and existing tfroot-libvirt recipients are unchanged. No SOPS ciphertext is read, changed, or decrypted.

Fixes #

None.

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending opentofu / test and opentofu / plan.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; this is the canonical central distribution declaration and no target-repository file was edited.
• Infrastructure-security review found no Critical, High, or Medium findings.
• Release review verified the net diff is restricted to the two intended Hero mappings, source fields remain unchanged, and the consumer workflow references the exact destination names.
• No local OpenTofu init, plan, apply, destroy, import, state operation, or secret decryption was run or claimed.

Impact and rollout

Producer: tfroot-github is the canonical owner of the encrypted-source reference and GitHub Actions secret distribution.

Consumer: after PR merge and the separate environment-gated main apply, hero-host-config will receive the two named secrets for its existing manual WARP/Ansible check-only workflow. Its existing tfroot-libvirt recipients remain unchanged.

Unchanged: no SOPS ciphertext, secret value, Cloudflare policy, WARP enrollment, repository workflow, public-key authorization, Hero host configuration, Node Exporter, firewall, GitOps desired state, or workflow dispatch is included.

Delivery stages: authored and submitted; PR validation is pending. Merge and the main apply are separate explicit confirmation gates. Hero public-key authorization and check-workflow dispatch remain separate operations after a successful apply.

Known follow-up: stale PR #62, superseded by merged WARP PRs #63 and #64, remains open and should be closed through a separately authorized cleanup action; it is not part of this change.

Rollback: close or revert this PR before apply. After apply, remove the two mappings through a reviewed PR and environment-gated apply; rotate the SSH identity separately if revocation is required.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: an OpenCode agent added only non-secret mappings after the owner confirmed the existing tfroot-libvirt SSH identity is the intended Hero identity.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
      + created_at        = (known after apply)
      + id                = (known after apply)
      + key_id            = (known after apply)
      + plaintext_value   = (sensitive value)
      + remote_updated_at = (known after apply)
      + repository        = "hero-host-config"
      + repository_id     = (known after apply)
[REDACTED: potentially sensitive plan output]
      + updated_at        = (known after apply)
    }

Plan: 2 to add, 0 to change, 0 to destroy.