feat: finish Pi and workspace management updates

tools/tht/internal/output/sanitize_test.go

@@ -105,6 +105,26 @@ func TestSecretValuesFromFilesRedactsEveryDotenvBundleValue(t *testing.T) {
 	}
 }
 
+func TestSecretValuesFromFilesAcceptsOpenSSHPrivateKey(t *testing.T) {
+	t.Parallel()
+
+	secretFile := filepath.Join(physicalTempDir(t), "git-ssh-key")
+	contents := "-----BEGIN OPENSSH PRIVATE KEY-----\n" +
+		"ZmFrZS1rZXktcGF5bG9hZA==\n" +
+		"-----END OPENSSH PRIVATE KEY-----\n"
+	if err := os.WriteFile(secretFile, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	secrets, err := SecretValuesFromFiles([]string{secretFile})
+	if err != nil {
+		t.Fatalf("SecretValuesFromFiles() error = %v, want OpenSSH key accepted", err)
+	}
+	if len(secrets) == 0 {
+		t.Fatal("SecretValuesFromFiles() returned no values for OpenSSH key")
+	}
+}
+
 func TestSanitizeRecognizesQuotedCredentialKeys(t *testing.T) {
 	t.Parallel()