Make the cancel actually remove the key it says it removed, instead of erroring into a swallowed stderr

Partnership/onboard_cancel.sh

@@ -181,14 +181,35 @@ if [[ "$DIRECTION" == "h1" || "$DIRECTION" == "both" ]]; then
             warn "DRY RUN — would remove HOST1 key from $MIRROR:/root/.ssh/authorized_keys"
             H1_DONE=true
         else
-            timeout "$SSH_TIMEOUT" ssh -i "$SSH_KEY" \
+            # `\|…|d`, not `|…|d`. sed only accepts a custom address delimiter when it is
+            # introduced by a backslash; the bare form is a syntax error — "unknown command: `|'".
+            # A delimiter other than / is still required, because the key blob is base64 and
+            # routinely contains /.
+            #
+            # The error went to 2>/dev/null and `echo ok` ran anyway, so this reported
+            # "key removed ✅" on every run while removing nothing, and a cancelled onboard left
+            # HOST1's key live on the mirror. Report on what the remote actually did instead.
+            _cancel_out=$(timeout "$SSH_TIMEOUT" ssh -i "$SSH_KEY" \
                 -o ConnectTimeout="$SSH_TIMEOUT" -o BatchMode=yes root@"$MIRROR_IP" \
-                "sed -i \"|${KEY_BLOB}|d\" /root/.ssh/authorized_keys 2>/dev/null
-                 sed -i \"/^${MIRROR_ID}_PHASE\|^${MIRROR_ID}_KEY_READY/d\" $(platform_setup_db_path) 2>/dev/null
-                 echo ok" 2>/dev/null | grep -q ok && {
+                "sed -i \"\\|${KEY_BLOB}|d\" /root/.ssh/authorized_keys || { echo sed-failed; exit 1; }
+                 sed -i \"/^${MIRROR_ID}_PHASE/d; /^${MIRROR_ID}_KEY_READY/d\" $(platform_setup_db_path) 2>/dev/null
+                 grep -qF '${KEY_BLOB}' /root/.ssh/authorized_keys 2>/dev/null && echo still-present || echo ok" 2>/dev/null)
+            case "$_cancel_out" in
+                *ok*)
                     echo "HOST1 key removed from $MIRROR authorized_keys ✅"
                     H1_DONE=true
-            } || warn "Could not SSH to $MIRROR — remove HOST1 key there manually"
+                    ;;
+                *still-present*)
+                    warn "HOST1 key still present in $MIRROR authorized_keys — remove it there manually"
+                    ;;
+                *sed-failed*)
+                    warn "Could not edit authorized_keys on $MIRROR — remove HOST1 key there manually"
+                    ;;
+                *)
+                    warn "Could not SSH to $MIRROR — remove HOST1 key there manually"
+                    ;;
+            esac
+            unset _cancel_out
         fi
     fi