v0.106.1: ssh-copy-id -s requires ~/.ssh locally — create it in the installer

Live finding: SFTP-mode ssh-copy-id mktemp's under ~/.ssh; the container
image has no /root/.ssh, so the install died locally AFTER the one-time
password was consumed (fail-safe held; password never transmitted).
Probe confirmed the pinned known_hosts + StrictHostKeyChecking=yes chain
is sound against the real box once ~/.ssh exists.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/offsiteapply/seams.go

@@ -146,6 +146,14 @@ func (SSHCopyIDInstaller) Install(ctx context.Context, host, user string, port i
 	if strings.TrimSpace(knownHosts) == "" {
 		return fmt.Errorf("ssh-copy-id: empty known_hosts — refusing to install without a pinned host key")
 	}
+	// ssh-copy-id -s (SFTP mode) mktemp's its batch file under ~/.ssh and dies LOCALLY if the directory
+	// doesn't exist — the container image ships without /root/.ssh (live finding: the one-time password was
+	// consumed, then the install failed before ever connecting).
+	if home, err := os.UserHomeDir(); err == nil {
+		if err := os.MkdirAll(filepath.Join(home, ".ssh"), 0o700); err != nil {
+			return fmt.Errorf("ssh-copy-id: ensure ~/.ssh (needed by -s mode): %w", err)
+		}
+	}
 	work, err := os.MkdirTemp("", "felhom-keyinstall-")
 	if err != nil {
 		return err