The forge's SSH terminal is off after every boot: the host key comes up mode 660; the forge should tighten its own key to 0600 at start #6671

Seen 2026-10-27 00:23Z on 0.7.272's boot: WARN [forge] ssh is off: the terminal could not start port=2222 reason="/data/ssh/host_ed25519 is mode 660; it must be 0600". On the pod, stat says 660 /data/ssh/host_ed25519. The forge's terminal over SSH (port 2222) is down until the next boot finds the key at 0600. The likely cause is the volume's group permissions being applied on mount (fsGroup), which re-widens the mode on every start.

Done when:

1. At boot the forge sets its own host key to 0600 (it owns the file) before checking it, and only refuses when it can't (logs why). The same goes for every private file under /data/ssh.
2. The front-door check adds ssh -p 2222 banner reachability, so "ssh is off" shows as an alarm, not a log line.
3. Test: a key written 0660 is tightened to 0600 at start and the terminal listens.

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.