feat(semaphore): wed-ssh as the canonical Semaphore SSH key

Adds wed-ssh (the universal automation account pre-baked in every
VM template) to the declared key set and switches the production
inventory to use it for both ssh_key and become_key. Retains
jarvis-ssh for cases that specifically need admin-level access.

This aligns Semaphore-driven jobs with the established homelab
convention: wed runs the playbooks, jarvis is the higher-privilege
admin account provisioned by linux-baseline.

Operator (Ryan) cleaned out the previous templates + inventory in
Semaphore before this commit so the configure step re-creates them
wired to wed-ssh on its next run.

ansible/group_vars/all/semaphore.yml

@@ -60,7 +60,17 @@ semaphore_config:
       ssh_login: git
       ssh_private_key: "{{ vault_gitea_deploy_key }}"
 
-    # SSH key Semaphore uses to reach the fleet as jarvis.
+    # SSH key for the universal automation account 'wed' — pre-baked in
+    # every mk-labs VM template. This is the canonical user Semaphore
+    # uses to reach the fleet.
+    - name: wed-ssh
+      type: ssh
+      ssh_login: wed
+      ssh_private_key: "{{ vault_wed_ssh_private_key }}"
+
+    # SSH key Semaphore can use to reach the fleet as jarvis (admin
+    # account provisioned by linux-baseline). Retained for jobs that
+    # specifically need jarvis-level access; the default is wed-ssh.
     - name: jarvis-ssh
       type: ssh
       ssh_login: jarvis
@@ -77,8 +87,10 @@ semaphore_config:
       type: file
       inventory_file: ansible/inventory.yml
       repository: homelab
-      ssh_key: jarvis-ssh
+      # wed is the universal automation account pre-baked in every VM
-      become_key: jarvis-ssh
+      # template. Semaphore uses it for fleet-wide jobs.
+      ssh_key: wed-ssh
+      become_key: wed-ssh
 
   environments:
     - name: default