chore(deploy): remove temp DEBUG block + document no-passphrase rule (#391)

The diagnostic block added in #390 served its purpose — it confirmed
the secret bytes matched the server's keypair (same fingerprint, no
CRLF, correct length). That isolated the real root cause: the private
key on the testes server had been generated with a passphrase, and
GitHub Actions has no way to enter passphrases interactively. The user
regenerated a fresh ed25519 key with `-N ""` and the next deploy ran
green end-to-end.

Two changes here:

- `.github/workflows/deploy-develop.yml`: removes the DEBUG block from
  the "Configure SSH" step. The workflow returns to its production
  shape (port-aware, accept-new TOFU, best-effort keyscan).

- `CLAUDE.md`: adds a note to the `TESTES_SSH_KEY` row in the deploy
  secrets table calling out the no-passphrase requirement, with the
  exact `ssh-keygen` invocation that gets it right and the misleading
  error symptom (`Permission denied (publickey,password)` looks
  identical to a wrong key). Future sessions won't repeat the cycle.

Co-authored-by: Claude <noreply@anthropic.com>

Author: rpgmem

.github/workflows/deploy-develop.yml

@@ -44,18 +44,6 @@ jobs:
           mkdir -p ~/.ssh
           echo "$SSH_KEY" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          # TEMP DEBUG (remover após resolver auth — issue de paste do secret).
-          # Tudo abaixo é seguro: fingerprint não vaza bytes da chave; head/tail
-          # do .pub derivado não vaza bytes da privada; `file` só reporta tipo.
-          echo "--- DEBUG: chave recebida do secret ---"
-          echo "Bytes:    $(wc -c < ~/.ssh/deploy_key)"
-          echo "Linhas:   $(wc -l < ~/.ssh/deploy_key)"
-          echo "Encoding: $(file ~/.ssh/deploy_key)"
-          echo "Header:   $(head -1 ~/.ssh/deploy_key)"
-          echo "Footer:   $(tail -1 ~/.ssh/deploy_key)"
-          echo "Fingerprint:"
-          ssh-keygen -lf ~/.ssh/deploy_key 2>&1 || echo "  (chave inválida — ssh-keygen rejeitou)"
-          echo "--- FIM DEBUG ---"
           # `TESTES_SSH_PORT` é opcional — VPS padrão usa 22; hospedagem
           # gerenciada (Hostinger, KingHost) costuma usar porta alta.
           PORT="${SSH_PORT:-22}"

CLAUDE.md

@@ -199,7 +199,7 @@ Reasoning: develop is single-maintainer integration territory, not a shared prod
 | --- | --- | --- |
 | `TESTES_SSH_HOST` | `ssh.testes.example.com` or `185.239.210.8` | DNS or IP of the testes host. **Hostname only, no port, no protocol prefix.** |
 | `TESTES_SSH_USER` | `wp-deploy` | Account with write access to the plugin dir |
-| `TESTES_SSH_KEY` | `-----BEGIN OPENSSH PRIVATE KEY-----…` | Private half of a dedicated keypair; public half goes in `~/.ssh/authorized_keys` on the testes host |
+| `TESTES_SSH_KEY` | `-----BEGIN OPENSSH PRIVATE KEY-----…` | Private half of a dedicated keypair; public half goes in `~/.ssh/authorized_keys` on the testes host. **Must have no passphrase** — generate with `ssh-keygen -t ed25519 -N "" -f <path>`. GitHub Actions cannot enter passphrases interactively; a passphrase-protected key surfaces as `Permission denied (publickey,password)` in the rsync step, indistinguishable from a wrong key. |
 | `TESTES_SSH_PORT` | `65002` | **Optional.** Defaults to `22`. Managed hosting (Hostinger, KingHost, Locaweb) usually exposes SSH on a high port — set this when so. |
 | `TESTES_REMOTE_PATH` | `/var/www/testes/wp-content/plugins/ffcertificate` | Absolute path; no trailing slash |