blancco-init: debug boots open SSH for root

With blancco.debug=1 the init now also creates /etc/debug.environment in
the new root (Blancco's isDebugMode, so 2_sshd starts sshd) and installs
root's authorized_keys from http://<server>/blancco/debug_authorized_keys.
Root is locked and sshd is key-only, so normal boots stay closed and a
debug boot without that file on the server stays closed too.

Used to find where Albus keeps the finished report in process=auto, which
never auto-backs-up to the share. Live GetPxeScript.aspx has a matching
"Blancco Drive Eraser (debug / SSH)" item (UEFI, 7.0 kernel, verbose);
not in the playbook menu.

playbook/blancco-init.sh

@@ -271,6 +271,22 @@ XEOF
 chmod +x /run/newroot/etc/X11/xinit/xinitrc.d/00-no-screen-blank.sh
 
 mkdir -p /run/newroot/proc /run/newroot/sys /run/newroot/dev /run/newroot/run /run/newroot/tmp
+# Debug boots only: Blancco's own debug mode (/etc/debug.environment makes
+# isDebugMode true, so 2_sshd starts sshd) plus an SSH key for root.
+# Root is locked and sshd is key-only, so without the key there is no way
+# in. The key is served from the PXE server and never baked in here.
+if [ -n "$DEBUG" ]; then
+    touch /run/newroot/etc/debug.environment
+    mkdir -p /run/newroot/root/.ssh
+    if wget -q -T 10 -O /run/newroot/root/.ssh/authorized_keys "http://$SERVER/blancco/debug_authorized_keys"; then
+        chmod 700 /run/newroot/root/.ssh
+        chmod 600 /run/newroot/root/.ssh/authorized_keys
+        echo "  debug: sshd on, root key installed"
+    else
+        echo "  debug: no debug_authorized_keys on server, SSH stays closed"
+    fi
+fi
+
 mount --move /proc /run/newroot/proc
 mount --move /sys /run/newroot/sys
 mount --move /dev /run/newroot/dev