The command no longer sends a shell script to the host. It fetches
~/.ssh/authorized_keys with the system sftp in batch mode, adds the key
line here, and writes the file back in a second session: mkdir and chmod
on ~/.ssh, put to authorized_keys.keyfunc-<random>, chmod 600, rename
over authorized_keys. Adding the line connects twice.
The file reads as empty only when sftp reported it as not there, in the
line naming that path; the same wording elsewhere -- ssh writes it about
an identity file it cannot find -- does not count, so a file that cannot
be read is never written over. A failed step removes nothing and names
the uploaded file once sftp's echo shows the put was reached.
Model: opus-5
