fix: normalize escaped SSH private key secrets

.gitea/workflows/terraform-apply.yml

@@ -85,13 +85,26 @@ jobs:
             exit 1
           fi
 
-          printf '%s\n' "$KEY_CONTENT" | tr -d '\r' > ~/.ssh/id_ed25519
+          KEY_CONTENT="$KEY_CONTENT" python3 -c 'import os, pathlib; key=os.environ.get("KEY_CONTENT", "").replace("\r", ""); key=key.replace("\\n", "\n") if "\\n" in key and "\n" not in key else key; pathlib.Path.home().joinpath(".ssh", "id_ed25519").write_text(key if key.endswith("\n") else key + "\n")'
           chmod 0600 ~/.ssh/id_ed25519
 
       - name: Verify SSH keypair match
         run: |
-          PRIV_FP="$(ssh-keygen -y -f ~/.ssh/id_ed25519 | ssh-keygen -lf - | awk '{print $2}')"
-          PUB_FP="$(printf '%s\n' "${{ secrets.SSH_KEY_PUBLIC }}" | tr -d '\r' | ssh-keygen -lf - | awk '{print $2}')"
+          if ! ssh-keygen -y -f ~/.ssh/id_ed25519 >/tmp/key.pub 2>/tmp/key.err; then
+            echo "Invalid private key content in SSH_KEY_PRIVATE/KUBEADM_SSH_PRIVATE_KEY"
+            cat /tmp/key.err
+            exit 1
+          fi
+
+          printf '%s\n' "${{ secrets.SSH_KEY_PUBLIC }}" | tr -d '\r' > /tmp/secret.pub
+          if ! ssh-keygen -lf /tmp/secret.pub >/tmp/secret.fp 2>/tmp/secret.err; then
+            echo "Invalid SSH_KEY_PUBLIC format"
+            cat /tmp/secret.err
+            exit 1
+          fi
+
+          PRIV_FP="$(ssh-keygen -lf /tmp/key.pub | awk '{print $2}')"
+          PUB_FP="$(awk '{print $2}' /tmp/secret.fp)"
 
           echo "private fingerprint: $PRIV_FP"
           echo "public  fingerprint: $PUB_FP"