feat: finish Pi and workspace management updates

tools/tht/internal/output/sanitize.go

@@ -122,6 +122,12 @@ func extractSecretValues(contents []byte) ([]string, error) {
 	if whole != "" {
 		values = append(values, whole)
 	}
+	// PEM files (including OpenSSH private keys) can contain base64 lines that look
+	// like dotenv assignments. Keep the complete document opaque instead of trying
+	// to parse it as a dotenv bundle.
+	if bytes.HasPrefix(trimmed, []byte("-----BEGIN ")) {
+		return values, nil
+	}
 
 	if trimmed[0] == '{' || trimmed[0] == '[' {
 		var document any