feat: allow overriding pull secret / SSH key location, prefer Ed25519

[butler54]

Summary

Fixes #37 and #23.

#37 — Allow Pull Secret and SSH Keys to be Specified by the end user

rhdp-cluster-define.py now resolves both paths itself, rather than the wrapper scripts hardcoding ~/pull-secret.json and ~/.ssh/id_rsa.pub:

• Pull secret: --pull-secret / PULL_SECRET env var override, else ~/pull-secret.json (unchanged default).
• SSH public key: --ssh-public-key / SSH_PUBLIC_KEY env var override, else auto-detect (see Update 'RHDP' wrapper script to support a wider variety of ssh keys #23 below).

Per the maintainer's own suggestion on #37 ("optional environmental var override... easiest way to be backwards compatible"), both env vars propagate to the rhdp-cluster-define.py subprocess automatically — no new flags needed on the wrapper scripts. Matching --pull-secret/--ssh-public-key CLI flags are also available for direct use of rhdp-cluster-define.py (via typer's native envvar= support — see --help).

Resolution now happens before cleanup() runs, so a missing pull secret or SSH key can't trigger a destructive directory wipe only to fail afterwards.

#23 — Update RHDP wrapper script to support a wider variety of SSH keys

SSH public key is now auto-detected when no override is given, preferring ~/.ssh/id_ed25519.pub, then id_ecdsa.pub, then id_rsa.pub (first match wins) — Ed25519 as current best practice, while remaining backwards compatible with existing RSA-only setups. Previously hardcoded to RSA only, with a TBC: Update to support other key types comment in the error message (now resolved).

Other changes

• Removed the three wrapper scripts' (wrapper.sh, wrapper-cluster-only.sh, wrapper-multicluster.sh) now-outdated hardcoded pre-flight checks, which required ~/pull-secret.json and ~/.ssh/id_rsa specifically and would otherwise block legitimate overrides or Ed25519-only setups. rhdp-cluster-define.py's validation (with clear, actionable error messages) is now the single source of truth.
• Updated rhdp/README.md with a new "Overriding pull secret / SSH key location" section.

Cross-repo / follow-up scope

While investigating, I found two related things intentionally left out of scope for this PR, each tracked separately:

1. scripts/gen-secrets.sh's separate podvm SSH-debug key (~/.coco-pattern/id_rsa, used for optional peer-pod SSH debugging, unrelated to the RHDP cluster-install SSH key this PR addresses) is also RSA-only. Cross-repo review (coco-pattern → sandboxed-containers-chart → sandboxed-policies-chart) confirmed it's no longer a hard peer-pods requirement (made optional in sandboxed-containers-chart PR feat: cleanup some defaults #7) but is still real, wired functionality. Modernizing it to support Ed25519 too would span 3 repos and needs verification of the upstream consumer's expectations — tracked in chore: modernize podvm SSH-debug key to support Ed25519 alongside RSA #129.
2. The docs site (validatedpatterns.io, sourced from validatedpatterns/docs) doesn't mention the rhdp/ wrapper scripts at all today, despite them being the recommended Azure deployment path (per Update documentation #59's comment thread). Tracked in docs: document RHDP wrapper deployment path and configurable secrets locations #131.

Test plan

• Scenario tests for resolve_pull_secret() / resolve_ssh_public_key(): no override + no keys (error), no override + RSA-only (backwards compat), no override + Ed25519 and RSA both present (prefers Ed25519), no override + ECDSA and RSA present (prefers ECDSA), override to a valid custom path, override to a missing path (error), pull secret missing/present/overridden.
• End-to-end CLI runs confirming: validation happens before cleanup() (no directories touched on failure), PULL_SECRET env var override works, Ed25519 auto-detection resolves and is correctly embedded in install-config.yaml.
• --help output confirms [env var: PULL_SECRET] / [env var: SSH_PUBLIC_KEY] are wired correctly.
• --recreate guard from the previous PR still works correctly.
• isort/black/flake8/mypy all pass against the pinned CI tool versions (isort 6.0.1, black 25.1.0, flake8 7.2.0, mypy 1.15.0).
• bash -n syntax check on all three wrapper scripts.
• Super Linter GitHub Action passes on this PR (final confirmation).