fix(push-host-keys): fall back to stdin when /dev/tty unavailable

Environments without a controlling terminal (containers, CI agents)
don't have /dev/tty. Try it first for the sudo password prompt, fall
back to plain stdin so the script works in both contexts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/secrets/push-host-keys.sh

@@ -66,8 +66,15 @@ prompt_sudo_password() {
     sudo_password="$SUDO_PASS"
     return
   fi
-  read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password < /dev/tty
-  echo >&2
+  # Prefer /dev/tty so the prompt works even when stdout/stdin are redirected;
+  # fall back to plain stdin for environments where /dev/tty isn't available.
+  if [[ -r /dev/tty && -w /dev/tty ]]; then
+    read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password < /dev/tty
+    echo >&2
+  else
+    read -r -s -p "sudo password for ${SSH_USER} on remote hosts: " sudo_password
+    echo >&2
+  fi
 }
 
 locally_managed_hosts() {