fix(slm): _ssh_key_usable helper — degrade to default identity on unreadable key, warn once (#11793)

[mrveiss]

Closes #11793

Thinking Path

Owner decision (2026-07-16): one safe helper, degrade + warn. Exhaustive grep found 9 sites gating -i <key> on crash-prone Path(...).exists() — the 7 filed plus api/nodes.py:2740 and api/code_sync.py:2550 (the latter keeps its hard-fail semantics, message corrected "not found" → "not usable").

What Changed

• New services/ssh_utils.py::_ssh_key_usable(path) (no existing shared ssh module fits; api modules already import services.*): missing key → False quietly (old behavior); PermissionError/OSError → False + ONE actionable WARNING per path (module-level seen-set) → ssh falls back to default identity. Success path unchanged when the key is readable.
• 9 sites migrated across sync_orchestrator.py, code_distributor.py, api/nodes_execution.py, api/nodes.py, api/code_sync.py.
• Adjacent real bug fixed in-scope: code_distributor.py built -o -o ConnectTimeout=30 (stray duplicate token — ssh rejects it; same bug(slm): malformed ssh command in node role-sync — stray '-o' breaks every sync ('no argument after keyword -o') #10277 bug class) — removed + regression-guarded by test_code_distributor_ssh_argv_is_wellformed.
• Conftest: root conftest real-loads services.ssh_utils (the AST-derived stub loop would otherwise MagicMock it truthy, silently re-adding -i everywhere).

Verification

• tests/services/: 321 passed / 1 skipped / 0 failed (313 baseline + 8 new helper tests: readable/missing/unreadable/warn-once-per-path/OSError/integration on the exact bug(slm): ssh key checks crash with PermissionError when key dir unreadable — Path(SSH_KEY_PATH).exists() at 7 sites #11793 traceback site — command built WITHOUT -i, no exception, one WARNING). Independent re-run identical.
• api/nodes_execution_test.py 149 passed. flake8 clean ×8. Full-sweep failures byte-identical to clean HEAD (cp-based revert/restore proof) — pre-existing, tracked in test(slm): whole-backend sweep RUN phase — 105 pre-existing runtime failures from sys.modules order-rot and never-run files (post-#11794) #11798.

Model Used

Claude Fable 5 (subagent: general-purpose)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!