fix(ssh): gate OpenBao host on validated machine data

[verlyn13]

Summary

Move machine-specific OpenBao SSH identity out of public source and gate management on validated private machine data.

• Adds a fail-closed four-field machine-data contract.
• Uses a chezmoi ignore interlock so absent data preserves an existing predecessor instead of deleting it.
• Rejects partial, malformed, wrong-type, injected, or ambiguous machine data before destination writes.
• Preserves the existing SSH Host-pattern and policy behavior when valid data is supplied.
• Narrows the remaining runtime privacy exception to path-only behavior so file content remains scanned.
• Adds isolated destination-semantics tests using synthetic data only.

Safety model

Machine-data absence means unmanaged/preserve, not deprovision.

A working predecessor remains byte-identical when the private OpenBao table is absent. Invalid data fails before destination mutation. Intentional deprovision remains a separate operator-authorized action.

Validation

• OpenBao destination-semantics suite: 172 passed, 0 failed.
• Public privacy suite: 21 passed, 0 failed.
• Production public privacy scan: PASS.
• System-update suite: 156 passed, 0 failed.
• Full scripts/validate-repo.sh: PASS.
• git diff --check: PASS.
• Commit has a valid SSH signature.
• Successor worktree is clean.

Operator-gated / not run

This PR does not:

• populate real private machine-data values;
• run a real-home chezmoi dry run or apply;
• rename the runtime SSH module;
• intentionally deprovision the host;
• query OpenBao, 1Password, Keychain, provider state, or host connectivity.

Those actions remain separate from source acceptance.