bootstrap: install ssh ControlMaster block for netbird peers

After preflight detects MESH_CONNECTED=netbird and the host yaml says
kind != lxc (i.e. workstation, vm, proxmox-host), drop a Host block into
the enrolling user's ~/.ssh/config:

    Host *.netbird.selfhosted
        ControlMaster auto
        ControlPath ~/.ssh/cm/%C
        ControlPersist 2h

This is the real workaround for netbird's SSH JWT cache being flaky in
0.71.2 — we discovered that --ssh-jwt-cache-ttl can leave the daemon in
a state where stale cached tokens get sent and rejected with no fallback
to fresh SSO. ssh ControlMaster bypasses netbird-ssh-proxy entirely for
subsequent sessions: one SSO at the start of a working window covers all
back-to-back ssh / scp / `pct exec` ops until ControlPersist expires.

Validated 2026-05-21 on republic-laptop: ssh #1 prompted SSO once,
sshes #2 and #3 ran in ~1.1s each with no prompt.

Idempotent (sentinel comment check); writes ~/.ssh/cm/ with 700; uses
SUDO_USER's home when invoked via sudo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -347,6 +347,49 @@ if [ "$MESH_CONNECTED" = "netbird" ]; then
     fi
 fi
 
+# -------- ssh ControlMaster for netbird peers (workstations) --------
+# Drop a Host block into the enrolling user's ~/.ssh/config so that ssh to
+# `*.netbird.selfhosted` multiplexes over a single connection. After one SSO
+# device-code completion, subsequent ssh / scp / `pct exec` invocations
+# (within ControlPersist=2h) reuse the master socket with no re-auth — the
+# real workaround for netbird's flaky SSH JWT cache. Skip on LXCs (no
+# outbound ssh expected from them).
+HKIND="$(python3 -c "import yaml; print(yaml.safe_load(open('$HOST_YAML')).get('kind',''))" 2>/dev/null || true)"
+if [ "$MESH_CONNECTED" = "netbird" ] && [ "$HKIND" != "lxc" ]; then
+    if [ -n "${SUDO_USER:-}" ] && [ "$SUDO_USER" != "root" ]; then
+        SSH_USER_HOME=$(eval echo "~$SUDO_USER")
+        SSH_OWNER="$SUDO_USER"
+    else
+        SSH_USER_HOME="$HOME"
+        SSH_OWNER=""
+    fi
+    SSH_CFG="$SSH_USER_HOME/.ssh/config"
+    SSH_CM_DIR="$SSH_USER_HOME/.ssh/cm"
+    SENTINEL="# homelab-bootstrap: ssh ControlMaster for netbird mesh"
+    if [ "$DRY_RUN" -eq 1 ]; then
+        echo "+ would write Host *.netbird.selfhosted ControlMaster block into $SSH_CFG"
+    elif [ -f "$SSH_CFG" ] && grep -qF "$SENTINEL" "$SSH_CFG"; then
+        echo "[bootstrap] ssh ControlMaster block already present in $SSH_CFG (skip)"
+    else
+        mkdir -p "$SSH_USER_HOME/.ssh" "$SSH_CM_DIR"
+        chmod 700 "$SSH_USER_HOME/.ssh" "$SSH_CM_DIR"
+        cat >> "$SSH_CFG" <<'SSHEOF'
+
+# homelab-bootstrap: ssh ControlMaster for netbird mesh
+# One SSO covers many back-to-back ssh/scp/pct ops within ControlPersist.
+Host *.netbird.selfhosted
+    ControlMaster auto
+    ControlPath ~/.ssh/cm/%C
+    ControlPersist 2h
+SSHEOF
+        chmod 600 "$SSH_CFG"
+        if [ -n "$SSH_OWNER" ]; then
+            chown -R "$SSH_OWNER":"$SSH_OWNER" "$SSH_USER_HOME/.ssh"
+        fi
+        echo "[bootstrap] ssh: installed ControlMaster block into $SSH_CFG"
+    fi
+fi
+
 # -------- done --------
 cat <<EOF