packaging: ssh-client for upgrade over SSH; fix --upgrade banner

- Add openssh-client to the image (Dockerfile.oci + the update overlay): git
  ships in the base but the CUDA runtime has no ssh, so `--upgrade --ssh-key`
  failed with `ssh: not found`. HTTPS upgrades already worked without it.
- run_oci.sh: fix the --upgrade banner — `(force)` showed even when force was 0
  (`${VAR:+…}` fires on the string "0"), and the auth line printed the ssh key
  path twice.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EPLnsRpNBzWCHLgkXATqRz

packaging/linux/Dockerfile.oci

@@ -160,6 +160,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       mesa-vulkan-drivers \
       pciutils \
       openssl \
+      openssh-client \
     && rm -rf /var/lib/apt/lists/*
 
 COPY --from=builder /opt/coderai /opt/coderai

packaging/linux/Dockerfile.update

@@ -47,4 +47,11 @@ RUN set -eux; \
 # falls back to nvidia-smi when absent, hence `|| true` keeps offline builds OK.
 RUN /opt/coderai/python/bin/python3 -m pip install --no-input --no-cache-dir "nvidia-ml-py>=12.0.0" || true
 
+# openssh-client so `coderai-docker --upgrade --ssh-key …` can fetch over SSH
+# (git is present but the CUDA runtime base ships no ssh). Tiny; keep the overlay
+# still fast. `|| true` keeps offline overlay builds working (HTTPS upgrade still
+# works without it).
+RUN apt-get update && apt-get install -y --no-install-recommends openssh-client \
+    && rm -rf /var/lib/apt/lists/* || true
+
 # ENTRYPOINT / EXPOSE / VOLUME / ENV / WORKDIR are inherited from the base image.

packaging/linux/run_oci.sh

@@ -383,8 +383,8 @@ if [[ "$UPGRADE" -eq 1 ]]; then
   echo "== CoderAI in-image upgrade =="
   echo "  engine:  $ENGINE"
   echo "  image:   $IMAGE_TAG"
-  echo "  ref:     $UPGRADE_REF${UPGRADE_FORCE:+   (force)}"
-  echo "  auth:    ${UPGRADE_SSH_KEY:+ssh key $UPGRADE_SSH_KEY}${UPGRADE_SSH_KEY:-https/anonymous}"
+  echo "  ref:     $UPGRADE_REF$([[ "$UPGRADE_FORCE" == "1" ]] && echo '   (force)')"
+  echo "  auth:    $([[ -n "$UPGRADE_SSH_KEY" ]] && echo "ssh key $UPGRADE_SSH_KEY" || echo 'https/anonymous')"
   echo "  pip:     $([[ "$UPGRADE_SKIP_PIP" == "1" ]] && echo 'skipped (--no-pip)' || echo 'sync deps if changed')"
 
   # Make sure a stale upgrade container from an aborted run doesn't block us.