fix(mkosi): generate volatile SSH host keys after preparation

[kvinwang]

Summary

Prevent development images from shipping one shared SSH host private key and generate volatile host keys after the writable /etc overlay is ready.

Changes

• Remove image-build-time SSH host keys from the mkosi artifact.
• Add an independent ssh.service drop-in that requires and starts after dstack-prepare.service.
• Generate missing host keys with ssh-keygen -A after dstack-prepare mounts the writable /etc overlay.
• Preserve Debian's sshd -t validation before the daemon starts.

The mkosi development image intentionally has volatile /etc state, so these host keys are per boot. Production images do not install openssh-server.

Verification

• The drop-in is installed under /usr/lib/systemd/system/ssh.service.d/, separate from the vendor unit.
• git diff --check passed.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.