fix: bootstrap and administer the Grace editor VM

[ajaxbits]

Summary

Fix the actual first-boot failures of grace-editor:

• Set ownership of the mounted /home/agent volume before the non-root bootstrap starts. Fresh ext4 roots were owned by root, preventing the clone.
• Add key-only, host-originated guest SSH access and persistent guest SSH host identity. Only the public administration key is committed; its private half stays in ~admin/.ssh/grace-editor on patroclus.
• Clone the private website repository over SSH using a guest-owned repository deploy key and GitHub's published host key.
• Install jujutsu, not the unrelated JSON utility named jj.
• Give systemd-managed tools a complete PATH, an explicit HOME, jj author defaults, and a successful-install stamp tied to the lockfile and Node version.
• Configure OpenCode's update policy globally, and check Astro's preview over loopback while presenting the LAN URL.
• Document administration, provider login, provisioning, and the distinction between Git deploy keys and Actions API access.

Validation

• Built the complete host configuration and the final VM/installation unit.
• Evaluated the final patroclusStripped toplevel (the host's deployed variant).
• Booted the rebuilt guest on patroclus. SSH, bootstrap, OpenCode, and Astro services are active.
• Verified HTTP 200 from both the editor and preview on the guest IP.
• Restarted the VM and compared SSH identity, deploy-key fingerprint, checkout revision, and dependency stamp: all persisted unchanged; bootstrap succeeded without reinstalling dependencies.
• Verified guest public HTTPS connectivity and blocked guest-to-host connections.
• Verified the corrected model policy in the companion website PR is active in the running OpenCode API, with no selectable models before Copilot login.

The guest's repository-scoped deploy key is already registered. Copilot still needs the user's OAuth login.

Live test deployment

The live repair is installed via a runtime-only override for the Grace VM's installation unit. A full host switch had unrelated service differences, so I did not activate that full system. The tested derivation is GC-rooted under /home/admin/.cache/grace-editor-debug/final-installer.

After this PR is merged and the host configuration deployed, remove that temporary override so future VM updates use the declarative installation unit:

sudo rm /run/systemd/system/install-microvm-grace-editor.service.d/90-bootstrap-fix.conf
sudo systemctl daemon-reload

The runtime override disappears on a host reboot, so deploy this PR before rebooting the host. The persistent guest volume is retained throughout.

The live guest is testing feat/opencode-website-editor from https://github.com/ajaxbits/gracebobber/pull/2. Production main has not been pushed or deployed.