NS1 is marchon@70.88.205.138 using ~/.ssh/id_ed25519. Private key bytes stay off git. Spawn, health, and kill go through ssh; remote workers bind loopback only.