PER-DC MAAS->libvirt POWER KEY -- new dc0 region (SEC-012)
Captured 2026-07-30 ON vr1-dc0-maas-01 (10.12.8.6), the region host.
==========================================================

-- the key is the SAME dc0-scoped key already authorized on the dc0 rack --
vcloud  ~/vr1-dc0-creds/vr1-dc0-maas-power_ed25519.pub:
256 SHA256:Dt/YXTXSF4nXGj9cz8f0owL+qreVpMYBVm/igW10FXY maas-virsh-pod (D-123 amendment; MAAS snap -> local libvirt) (ED25519)
dc0 rack ~/.ssh/authorized_keys:
256 SHA256:DBkeStCyf2qGi3SYuvN6hQ+EsepmhpkN9oulLz09uAs vr1-dc0_svc (D-126 per-env key) (ED25519)
256 SHA256:Dt/YXTXSF4nXGj9cz8f0owL+qreVpMYBVm/igW10FXY maas-virsh-pod (D-123 amendment; MAAS snap -> local libvirt) (ED25519)

-- named check, run on the region host --
$ maas-region-power-key.sh check vr1-dc0 qemu+ssh://jessea123@10.12.8.2/system
maas-region-power-key check: site=vr1-dc0 dc=dc0 rack=10.12.8.2 user=jessea123
  key=/var/snap/maas/current/root/.ssh/id_dc0_power
  [ok]   power key present
  [ok]   key mode is 0600 (got 600)
  [ok]   key owned by root (got root)
  [ok]   key parses as a valid PRIVATE key (SHA256:Dt/YXTXSF4nXGj9cz8f0owL+qreVpMYBVm/igW10FXY)
  [ok]   ssh config present
  [ok]   config binds Host 10.12.8.2 -> /var/snap/maas/current/root/.ssh/id_dc0_power
  [ok]   config sets IdentitiesOnly yes for 10.12.8.2
  [ok]   REAL virsh (snap run --shell maas -c virsh) connect to qemu+ssh://jessea123@10.12.8.2/system succeeds
  [ok]   virsh enumerates domains on the rack (got 12)
maas-region-power-key: 9 passed, 0 failed
  EXIT = 0