Install OpenSSH Server during Windows setup

Install it at first logon from the Win32-OpenSSH zip on the seed ISO via
Configure-Windows.ps1 -InstallOpenSSH, replacing the manual 05/06 batch
files. The administrator public key now comes from the host
(SSH_PUBLIC_KEY_FILE or ~/.ssh/id_*.pub) instead of being hardcoded.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

seediso/windows11/build-seed.sh

@@ -17,6 +17,16 @@ openssh_zip="$(VM_IMAGE_ARCH="$answer_arch" "$image_helper" --print-path openssh
 [[ -s "$openssh_zip" ]] || VM_IMAGE_ARCH="$answer_arch" "$image_helper" openssh-win
 [[ -s "$openssh_zip" ]] || { printf 'Error: %s was not downloaded.\n' "$openssh_zip" >&2; exit 1; }
 
+# The public key for administrator SSH login: SSH_PUBLIC_KEY_FILE, else the
+# first default key of the invoking user. The guest skips it when absent.
+ssh_key="${SSH_PUBLIC_KEY_FILE:-}"
+if [[ -z "$ssh_key" ]]; then
+  for candidate in "$HOME"/.ssh/id_ed25519.pub "$HOME"/.ssh/id_ecdsa.pub "$HOME"/.ssh/id_rsa.pub; do
+    [[ -f "$candidate" ]] && { ssh_key="$candidate"; break; }
+  done
+fi
+[[ -z "$ssh_key" || -f "$ssh_key" ]] || { printf 'Error: %s does not exist.\n' "$ssh_key" >&2; exit 1; }
+
 # The answer file's components name the processor architecture, so render a
 # copy for the target architecture.
 work_dir="$(mktemp -d)"
@@ -29,6 +39,10 @@ seed_files=(
   "$script_dir/Configure-Windows.ps1"
   "$openssh_zip"
 )
+if [[ -n "$ssh_key" ]]; then
+  cp -- "$ssh_key" "$work_dir/authorized_keys"
+  seed_files+=("$work_dir/authorized_keys")
+fi
 # Numbered installer scripts (10-Install-Git-Admin.bat, 20-..., in install order).
 shopt -s nullglob
 seed_files+=("$script_dir"/[0-9][0-9]-*.bat)