fix: deep-merge manifest with base to resolve container user UID/GID

- start_instance now deep-merges manifest with base definition before extracting user.uid/user.gid
- The user config is typically defined in the base image (ubuntu-24.04-dev), not the extending manifest
- Add debug logging to verify resolved uid/gid/home_dir
- Add logging to prepare_ssh_key_files for chown success/failure visibility
- Log current process uid when chown fails to diagnose permission issues

Quality gates: pytest 239 passed (6 pre-existing failures), tsc --noEmit clean

apps/api/src/services/ssh_keys.py

@@ -1,5 +1,6 @@
 """SSH key service utilities for preparing keys for container use."""
 
+import logging
 import os
 from pathlib import Path
 
@@ -7,6 +8,8 @@ from cryptography.fernet import Fernet
 
 from src.config import Settings
 
+logger = logging.getLogger(__name__)
+
 
 def _get_fernet() -> Fernet:
     """Generate a valid Fernet key from the session secret."""
@@ -75,10 +78,20 @@ def prepare_ssh_key_files(
             os.chown(private_key_path, effective_uid, effective_gid)
             os.chown(public_key_path, effective_uid, effective_gid)
             os.chown(config_path, effective_uid, effective_gid)
-        except PermissionError:
-            # API process may not be running as root; permission fixer will
-            # handle this post-start if the mount is read-write
-            pass
+            logger.debug(
+                "Set SSH key ownership to uid=%s gid=%s for %s",
+                effective_uid,
+                effective_gid,
+                ssh_dir,
+            )
+        except PermissionError as exc:
+            logger.warning(
+                "Cannot chown SSH keys to uid=%s gid=%s (running as uid=%s): %s",
+                effective_uid,
+                effective_gid,
+                os.getuid(),
+                exc,
+            )
 
     return str(ssh_dir)