chmod authorized_keys after every rewrite, so revoking a key does not disable the file

grep -v > tmp && mv keeps the temp file's umask mode, so an offboard left authorized_keys 0666 and sshd StrictModes silently refused every key in it — including the one the next onboard installs.

Partnership/onboard_cancel.sh

@@ -192,6 +192,7 @@ if [[ "$DIRECTION" == "h1" || "$DIRECTION" == "both" ]]; then
             _cancel_out=$(timeout "$SSH_TIMEOUT" ssh -i "$SSH_KEY" \
                 -o ConnectTimeout="$SSH_TIMEOUT" -o BatchMode=yes root@"$MIRROR_IP" \
                 "sed -i \"\\|${KEY_BLOB}|d\" /root/.ssh/authorized_keys || { echo sed-failed; exit 1; }
+                 chmod 600 /root/.ssh/authorized_keys 2>/dev/null
                  sed -i \"/^${MIRROR_ID}_PHASE/d; /^${MIRROR_ID}_KEY_READY/d\" $(platform_setup_db_path) 2>/dev/null
                  grep -qF '${KEY_BLOB}' /root/.ssh/authorized_keys 2>/dev/null && echo still-present || echo ok" 2>/dev/null)
             case "$_cancel_out" in
@@ -249,7 +250,9 @@ if [[ "$DIRECTION" == "h2" || "$DIRECTION" == "both" ]]; then
         warn "DRY RUN — would remove $MIRROR_SHORT key from $AUTH_KEYS"
         H2_DONE=true
     else
-        sed -i "/${MIRROR_SHORT}/Id" "$AUTH_KEYS" && {
+        # chmod after: sed -i rewrites via a temp file, which lands under the umask and can
+        # leave the file 0666. sshd StrictModes then silently refuses every key in it.
+        sed -i "/${MIRROR_SHORT}/Id" "$AUTH_KEYS" && chmod 600 "$AUTH_KEYS" && {
             echo "$MIRROR key removed from HOST1 authorized_keys ✅"
             H2_DONE=true
         } || warn "Failed to remove $MIRROR key from HOST1 authorized_keys"