cc-ci host: keys generated on the host, nothing copied from another machine

Operator: no ssh keys or non-essential secrets from the old orchestrator
box on the cc-ci host. `ssh cc-ci` uses cc-ci-local-ed25519 (generated on
the host, pub in nix/hosts/cc-ci/ssh-keys); pushes to Gitea use
autonomic-bot-cc-ci-ed25519 (generated on the host, registered on the bot
account); root reuses that file for the cc-ci-secrets submodule. README §4:
the /secrets/files inventory shrinks to exactly what cc-ci needs, and §4b
now says to make the host a sops recipient and take the master key away.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz

nix/modules/orchestrator-host.nix

@@ -23,7 +23,8 @@ in
       example = "100.95.31.88";
       description = ''
         Where `ssh cc-ci` (used by every skill and script that drives the CI server) connects to,
-        as root with ~loops/.ssh/cc-ci-root-ed25519. On the combined host the CI server IS this
+        as root with ~loops/.ssh/cc-ci-local-ed25519 (a key generated ON the host — nothing
+        copied from another machine). On the combined host the CI server IS this
         machine, so the default is loopback; a standalone orchestrator points it at the CI
         server's tailnet address.
       '';
@@ -112,7 +113,7 @@ in
 Host cc-ci
     HostName ${cfg.ciSshHost}
     User root
-    IdentityFile /home/loops/.ssh/cc-ci-root-ed25519
+    IdentityFile /home/loops/.ssh/cc-ci-local-ed25519
     IdentitiesOnly yes
     StrictHostKeyChecking accept-new
     ServerAliveInterval 30
@@ -121,7 +122,7 @@ Host git.autonomic.zone
     HostName git.autonomic.zone
     Port 2222
     User git
-    IdentityFile /home/loops/.ssh/autonomic-bot-gitea-ed25519
+    IdentityFile /home/loops/.ssh/autonomic-bot-cc-ci-ed25519
     IdentitiesOnly yes
 SSHCFG
         chmod 600 /home/loops/.ssh/config