fix: SSH agent not started before git clone/push in deploy_debian_repo workflow

[Copilot]

The "Commit and push Debian repository" step failed with Host key verification failed / exit 128 because: (1) no ssh-agent was started, leaving SSH_AUTH_SOCK unset in the subsequent step's shell process; (2) ssh-keyscan exits 0 even on empty output, silently producing an unusable known_hosts.

Changes

• ssh-agent lifecycle: start agent with eval "$(ssh-agent -s)" and export SSH_AUTH_SOCK/SSH_AGENT_PID to $GITHUB_ENV so the agent is reachable in downstream steps
• Key loading: ssh-add - <<< "${DEBIAN_REPO_SSH_PRIVATE_KEY}" loads the key into the agent via stdin (never written to disk)
• Verified known_hosts: capture ssh-keyscan -t ed25519,rsa,ecdsa github.com output into a variable and fail fast if empty before appending to known_hosts
• Explicit core.sshCommand: set ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes so git uses only the agent key and keeps strict host-key verification

eval "$(ssh-agent -s)"
echo "SSH_AUTH_SOCK=${SSH_AUTH_SOCK}" >> "${GITHUB_ENV}"
echo "SSH_AGENT_PID=${SSH_AGENT_PID}" >> "${GITHUB_ENV}"
ssh-add - <<< "${DEBIAN_REPO_SSH_PRIVATE_KEY}"

known_hosts_content="$(ssh-keyscan -t ed25519,rsa,ecdsa github.com 2>/dev/null)"
if [[ -z "${known_hosts_content}" ]]; then
  echo "ssh-keyscan returned no host keys for github.com" >&2
  exit 1
fi
printf '%s\n' "${known_hosts_content}" >> "${HOME}/.ssh/known_hosts"

git config --global core.sshCommand \
  "ssh -o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"