fix: set NIX_SSHOPTS for deploy-rs SSH authentication

deploy-rs uses nix copy which doesn't read ~/.ssh/config. Set
NIX_SSHOPTS to pass the deploy key and IdentitiesOnly directly
to the SSH invocations.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: stackptr

.github/workflows/deploy.yml

@@ -62,6 +62,8 @@ jobs:
           EOF
 
       - name: Deploy to ${{ matrix.host }}
+        env:
+          NIX_SSHOPTS: "-i ~/.ssh/deploy_key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new"
         run: |
           nix run --inputs-from . deploy-rs -- \
             .#${{ matrix.host }} \