Do not silently swap a key just to make one route work.
Reconcile Pi authorized_keys, Forgejo registered keys,
VPS authorized_keys, and feed metadata through the
public-key grant contract.
Any feed or contract update should be made through
from-admin/Rise_of_Pi-OS, validated with the feed publish
script, committed to Forgejo, and then published.
GitHub remains supplemental only; private Forgejo repos are the
primary operating model.