fix(runner-watchdog): use RUNNER_SSH_KEY for runner host SSH (DAK-7637)

[ferhimedamine]

Problem

The wedged-runner watchdog was using DEPLOY_SSH_KEY to SSH into the runner hosts. This key is authorized on the prod server (178.104.45.161) but NOT on the runner hosts:

• ARM runner (168.119.60.30): only RUNNER_SSH_KEY (ops@dakera.ai) + deploy key is NOT in authorized_keys
• x64 runner (178.104.227.173): only RUNNER_SSH_KEY (ops@dakera.ai)

Result: both SSH connections returned Permission denied (publickey), the watchdog couldn't restart the runners, and sent a "Manual intervention required" Telegram to the founder.

Fix

1. New secret RUNNER_SSH_KEY — added to dakera-deploy repo (ops@dakera.ai ED25519, authorized on both runner hosts). Already set out-of-band.
2. Watchdog uses RUNNER_SSH_KEY instead of DEPLOY_SSH_KEY for runner host SSH.
3. Alert message — replaced "Manual intervention required — SSH into..." with "Platform agent will investigate and self-heal." Platform owns runner recovery; founder should never be asked to SSH.

Verification

• Runner hosts confirmed reachable with ops key: ssh -i ~/.ssh/id_ed25519 root@168.119.60.30 ✅
• ARM runner restarted manually (DAK-7637), reconnected to GitHub, now processing previously-queued CI job (run 30619220135) ✅
• RUNNER_SSH_KEY secret set in dakera-deploy ✅

Root cause trail

DAK-7637 alert → watchdog run 30620415976 → Permission denied (publickey) on both hosts → wrong key secret used.

Co-Authored-By: Platform Agent noreply@anthropic.com