- Add openssh-client to the image (Dockerfile.oci + the update overlay): git
  ships in the base but the CUDA runtime has no ssh, so `--upgrade --ssh-key`
  failed with `ssh: not found`. HTTPS upgrades already worked without it.
- run_oci.sh: fix the --upgrade banner — `(force)` showed even when force was 0
  (`${VAR:+…}` fires on the string "0"), and the auth line printed the ssh key
  path twice.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz