Fix: Complete SSH bootstrap hardening

.claude/docs/specs/2026-08-25-server-role.md

@@ -138,10 +138,16 @@ steps, each checked and skipped when already true:
    exists, use it.
 2. Ensure the user has a password (needed for sudo) — `passwd` interactively
    if none is set.
-3. Copy root's `authorized_keys` to the user when the user has none.
-4. Offer sshd hardening (yes/no, default yes): drop-in under
-   `/etc/ssh/sshd_config.d/` with `PermitRootLogin no`,
-   `PasswordAuthentication no`, then reload sshd. Skipped when already set.
+3. Copy root's `authorized_keys` only after OpenSSH parses every key line. The
+   destination directory and file are created as the target UID at `0700/0600`
+   and revalidated before hardening is available.
+4. Offer sshd hardening (yes/no, default yes): atomically install
+   `/etc/ssh/sshd_config.d/00-panama.conf` with `PermitRootLogin no`,
+   `PasswordAuthentication no`, and `KbdInteractiveAuthentication no`. Run
+   `sshd -t` plus effective root/target `sshd -T -C` checks before reloading the
+   detected unit. Restore a prior regular file with metadata on failure. A
+   missing unit or unsupported existing drop-in leaves SSH unchanged and
+   bootstrap continues. The later binding transaction design owns the details.
 5. Move/clone the checkout under the user's home, chown it, and re-exec
    `install --server` as that user.