Found via SSH log analysis (Run #2003, task 2334): the "Verify SSH
Key and Secrets" step failed immediately with
"DEPLOY_SSH_KEY_B64 or DEPLOY_SSH_KEY not configured" -- both were
empty. Queried GET /repos/{repo}/actions/secrets directly and found
the actually-registered secrets are named SSH_PRIVATE_KEY and
QUANTENGINE_DB_PASSWORD; DEPLOY_SSH_KEY_B64/DEPLOY_SSH_KEY were never
created, despite CLAUDE.md claiming "SSH credentials: SSH_KEY
registered in Gitea Secrets".
Every past deploy-prod.yml run that reached the SSH step (e.g. Run
#1991's Pre-Deployment Verification) failed here for the same reason
-- this was never a working path, just never diagnosed down to the
secret name before now.
Fix: check secrets.SSH_PRIVATE_KEY first (with the same PEM-vs-base64
auto-detection used for the legacy names), falling back to
DEPLOY_SSH_KEY_B64 / DEPLOY_SSH_KEY in case those get added later.
Applied to all three places that build ~/.ssh/deploy_key (deploy job
verify + setup, and post-deploy-check's setup).
kjh2064
c8c558841e