docker: alpine base with openssh-client, mount SSH key + NET_RAW for scheduler

- Switch Dockerfile from distroless/static to alpine:3.21
- Install openssh-client-default in runtime image
- Mount SSH key in scheduler service (docker-compose)
- Add NET_RAW capability for ping checks
- Wire OIKOS_SSH_KEY_PATH and OIKOS_SSH_USER env vars in scheduler
- sshExec uses configured key path with StrictHostKeyChecking=no

internal/scheduler/scheduler.go

@@ -26,6 +26,11 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+var (
+	sshKeyPath string
+	sshUser    string
+)
+
 // Run starts the scheduler loop. Blocks until ctx is cancelled.
 func Run(ctx context.Context, pool *db.Pool, cfg config.Config) {
 	slog.Info("scheduler: starting", "interval", cfg.SchedulerInterval)
@@ -34,6 +39,12 @@ func Run(ctx context.Context, pool *db.Pool, cfg config.Config) {
 		interval = 30 * time.Second
 	}
 
+	sshKeyPath = cfg.SSHKeyPath
+	sshUser = cfg.SSHUser
+	if sshUser == "" {
+		sshUser = "root"
+	}
+
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
@@ -537,7 +548,7 @@ func checkSSHScript(ctx context.Context, cd sqlcgen.ListEnabledCheckDefsRow) che
 		cfg.Port = 22
 	}
 	if cfg.User == "" {
-		cfg.User = "root"
+		cfg.User = sshUser
 	}
 
 	if !allowlistedScript(cfg.Script) {
@@ -609,12 +620,14 @@ func allowlistedScript(name string) bool {
 func sshExec(ctx context.Context, addr, user, cmd string, timeout time.Duration) ([]byte, error) {
 	args := []string{
 		"-o", "ConnectTimeout=" + strconv.Itoa(int(timeout.Seconds())),
-		"-o", "StrictHostKeyChecking=yes",
+		"-o", "StrictHostKeyChecking=no",
 		"-o", "BatchMode=yes",
-		"-l", user,
-		addr,
-		cmd,
+		"-o", "UserKnownHostsFile=/dev/null",
 	}
+	if sshKeyPath != "" {
+		args = append(args, "-i", sshKeyPath)
+	}
+	args = append(args, "-l", user, addr, cmd)
 	c := exec.CommandContext(ctx, "ssh", args...)
 	return c.Output()
 }