Fix SSH key creation as a uid without passwd entry (ssh-keygen, ssh-keyscan, ssh-add wrappers)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Dockerfile

@@ -98,10 +98,13 @@ COPY --from=dockercli /docker /usr/local/bin/docker
 COPY server/ghidra /app/ghidra
 # git for agent shells: commits get the co-author trailer of the model (server.commit_trailer).
 COPY --chmod=755 docker/git-coauthor /usr/local/lib/codecraft/bin/git
-# ssh/scp/sftp also work when the container runs as a uid without passwd entry.
+# ssh, scp, sftp and the ssh-* tools (the server creates keys with ssh-keygen) also work when the container runs as a uid without passwd entry.
 COPY --chmod=755 docker/ssh-nss /usr/local/bin/ssh
 COPY --chmod=755 docker/ssh-nss /usr/local/bin/scp
 COPY --chmod=755 docker/ssh-nss /usr/local/bin/sftp
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/ssh-keygen
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/ssh-keyscan
+COPY --chmod=755 docker/ssh-nss /usr/local/bin/ssh-add
 COPY server/resources /app/resources
 # The agent's home lives on the data volume: tools it installs in user space
 # (pip --user, pipx, rustup, npm -g, downloaded binaries) survive rebuilds.