feat(vms): add SSH key + qemu-guest-agent to UniFi VM for ops/debugging

The first UOS bring-up left no way into the guest (cloud-init set no
credentials), so the in-guest UOS install couldn't be observed. Add:
- ssh_authorized_keys (public key, safe to commit) on the default ubuntu user
- qemu-guest-agent (KubeVirt AgentConnected + virtctl guest access)
- tee the install-uos output to the serial console + /var/log/uos-install.log,
  and record the installer exit code, so the install is observable.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

apps/vms/unifi/30-virtualmachine.yaml

@@ -95,9 +95,15 @@ spec:
               #cloud-config
               hostname: unifi
               fqdn: unifi.home.keithjackson.dev
+              # Break-glass OS access on the default `ubuntu` user (public key — safe to commit) for
+              # ops/debugging. qemu-guest-agent (below) additionally enables `virtctl` guest access.
+              ssh_pwauth: false
+              ssh_authorized_keys:
+                - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCq3JM7CD3P+OExaD4sQARLDQUf5QqDRemAO0qWA3fG7O/6ncgX0d/xN95lJ5Ei8LewlzXF5cCVe43oJ5CJRjh41igWZ38XXgOQcbAbY0lZTJlJg/SAj9Xni++JY3Jws5Nslm8qCrqt1bDsP3O3Lnp4hmBVZ+1eJy3v9HlJ2/1mVOukIob/zVXQNdOpVx1+oubNqo+UYt3l1IxqF8x+2JlHt+POaTBMqbC3JDCaStkkHN20xItpydHZ2uSamXaTx2MH+rQjrABjuD6Xxbhxhx0hG2XrVDWyAuq91aZUpuDkybcuHnpQUSHeZJCMqDCd3Q8yd/dyifDZE8QcnY5hiVHJF8VzJT/r5+em+I4LESlE5WNfq80TWG42d9gw7Yi/8xT38iDm+0nArMd/laAPpH0JGvdIyMdWcVZgfWTgcT6EZ9cIK2J4N+ijrh/V+xwzApmYyMdVsu2UjMeKrJG4VZk43XKnpfJCLJ2LmwtPMKqrI+wyge9Bav2+t+taznKP141gL6YJW3gwArzj+oktK+/fbahtBAUnjh5emLb2rv0gbAHC9cNbovEIdA3A6FDME96zAlozU4AtoCTA7SA1AqIHuAOHkqGYFBV77eriO85K0J1qo0FwuByFINI6G/JtEnNa+CjJLvh0clJonw+6+iR2vB1hwfDmLLwrE7QRT7Ho9w== [email protected]
               package_update: true
               package_upgrade: false            # skip slow first-boot upgrade; base image is recent
               packages:
+                - qemu-guest-agent              # KubeVirt guest integration + virtctl guest access
                 - podman
                 - uidmap
                 - slirp4netns
@@ -131,7 +137,9 @@ spec:
                     yes | "$tmp"
                     echo "UOS install finished; 'uosserver status' should report running (UI :11443)"
               runcmd:
+                - [ systemctl, enable, --now, qemu-guest-agent ]
                 - [ systemctl, enable, --now, podman.socket ]
-                # Full unattended install; logs to /var/log/uos-install.log. Non-fatal so a failed
-                # install leaves the VM up for `sudo install-uos` via console (KubeVirt virtctl).
-                - [ 'bash', '-lc', '/usr/local/sbin/install-uos > /var/log/uos-install.log 2>&1 || echo "UOS install failed; see /var/log/uos-install.log then rerun: sudo install-uos"' ]
+                # Full unattended install; tee to the serial console AND /var/log/uos-install.log for
+                # visibility. Non-fatal so a failed install leaves the VM up for `sudo install-uos`.
+                - [ 'bash', '-lc', '/usr/local/sbin/install-uos 2>&1 | tee /var/log/uos-install.log | tee /dev/console; echo "install-uos exit=${PIPESTATUS[0]}" | tee -a /var/log/uos-install.log > /dev/console' ]
+              final_message: "cloud-init finished; UOS install log at /var/log/uos-install.log (UI :11443)"