fix(ipa): work around OpenSSH 10 AuthorizedKeysCommand path check

OpenSSH 10.0 tightened AuthorizedKeysCommand security by checking every
path component of the command binary for group/world-write permission.
/nix/store is 1775 (group-writable by nixbld), so sshd silently skips
the command for any binary in the Nix store — causing IPA pubkey auth to
silently fail with no diagnostic.

Fix: copy sss_ssh_authorizedkeys to /usr/local/bin via systemd tmpfiles
(C+ copies the file rather than symlinking, so the path at runtime is
root-owned/755 throughout), and point AuthorizedKeysCommand at the copy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ipa/client.nix

@@ -63,8 +63,19 @@ in
   # Fetch SSH public keys from IPA so users can log in with the key stored
   # in their IPA profile rather than needing ~/.ssh/authorized_keys on every
   # host. sss_ssh_authorizedkeys queries SSSD (which queries IPA LDAP).
+  #
+  # /nix/store is 1775 (group-writable by nixbld). OpenSSH 10.0+ rejects
+  # AuthorizedKeysCommand binaries whose path contains any group-writable
+  # component, silently skipping the command. Copy to /usr/local/bin (all
+  # components root-owned, 755) so the path passes sshd's safety check.
+  systemd.tmpfiles.rules = [
+    "d /usr/local 0755 root root - -"
+    "d /usr/local/bin 0755 root root - -"
+    "C+ /usr/local/bin/sss_ssh_authorizedkeys 0555 root root - ${pkgs.sssd}/bin/sss_ssh_authorizedkeys"
+  ];
+
   services.openssh.extraConfig = ''
-    AuthorizedKeysCommand ${pkgs.sssd}/bin/sss_ssh_authorizedkeys %u
+    AuthorizedKeysCommand /usr/local/bin/sss_ssh_authorizedkeys %u
     AuthorizedKeysCommandUser nobody
   '';