Derive public keys on every run and update their files only when the content changes, so existing public keys cannot become stale. BREAKING CHANGE: The role no longer generates a key pair automatically when root.ssh.private_keys is empty or omitted. Provide private keys explicitly when needed. Co-authored-by: Copilot <copilot@github.com>