Storing the raw PEM as a secret mangled it (CRLF/whitespace/newline),
causing ssh to fail with "error in libcrypto" at the copy step. Store the
key base64-encoded and decode it in the workflow so the PEM round-trips
intact.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>