The key keeper is ssh-client's published package sshkeys, taken by series by the three build modules; Said, KindBuilder, ExecRunnerClean from the Delivery sdk (B5d; ADR 0634 §1; issue 1966)

Claude-Session: https://claude.ai/code/session_01NcbgfFSnn24M3GcqttoU7i

modules/mesh-build-node/cmd/mesh-build-node/fetch_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	dforgekey "git.novox.be/novox/mesh-delivery/sdk/forgekey"
 	"git.novox.be/novox/mesh-sdk/go/forgekey"
 )
 
@@ -269,7 +270,7 @@ func TestNoCommandOfTheStepSeesATokenOfTheProcess(t *testing.T) {
 		}
 	}
 	// The runner main wires: what it hands a command is exactly what the step gave.
-	ran := forgekey.ExecRunnerClean(10*time.Second)(context.Background(), append(m.baseEnv(), "ONLY=this"), "env")
+	ran := dforgekey.ExecRunnerClean(10*time.Second)(context.Background(), append(m.baseEnv(), "ONLY=this"), "env")
 	if ran.Status != 0 || strings.Contains(ran.Stdout, "hunter") || !strings.Contains(ran.Stdout, "ONLY=this") {
 		t.Errorf("the clean runner printed %q", ran.Stdout)
 	}