#511 Support vault-sourced identity keys

Problem

@swamp/ssh only accepts identityFile (a filesystem path) for SSH key authentication. When the private key lives in a vault (1Password, AWS SM, etc.), users must write a wrapper workflow that:

1. Pulls the key from the vault to a temp file
2. Runs the SSH operation
3. Cleans up the temp file

This is error-prone (key left on disk if cleanup fails) and adds boilerplate to every workflow that uses SSH with vault-managed keys.

Proposed solution

Add an identityKey transport option that accepts a vault expression directly:

transport:
  kind: ssh
  identityKey: \${{ vault.get('my-vault', 'node-ssh-key/private-key') }}

When identityKey is set, @swamp/ssh would:

• Write the key to a temp file with 0o600 permissions in a 0o700 directory
• Pass the temp path as -i to OpenSSH
• Clean up the file after the operation completes (in a finally block)

identityFile and identityKey should be mutually exclusive.

Alternatives considered

• Current workaround: Provision/cleanup in a wrapper workflow using a custom model. Works but adds 2 extra jobs and leaves cleanup to the user.
• Environment variable: OpenSSH doesn't support identity keys via env vars, so this isn't viable without a temp file internally anyway.

Upstream repository: https://github.com/systeminit/swamp-extensions

Environment

• Extension: @swamp/ssh@2026.05.29.2
• swamp: 20260527.235818.0-sha.ed572875
• OS: darwin (aarch64)
• Deno: 2.7.14+19bd3d8
• Shell: /bin/zsh