Fix Linux template cleanup and document Ubuntu boot setup

misc/README-ubuntu-systemd.md

+
+# CIRCLE Agent – Ubuntu 26.04 boot and template notes
+
+## Boot sequence
+
+- `agent.service` starts as a long-running systemd service.
+- `networking.service` may finish with loopback only.
+- The CIRCLE manager sends IP configuration later through
+  `/dev/virtio-ports/agent`.
+- The agent configures interfaces using ifupdown.
+- Do not add `After=agent.service` to networking.service:
+  Type=simple does not indicate that contextualization is complete.
+- SSH can start before the interface receives its IP address.
+
+## SSH host keys
+
+Cloned templates may not satisfy `ConditionFirstBoot=yes`.
+
+Run `misc/configure-ubuntu-systemd.sh` to configure Ubuntu's
+`sshd-keygen.service` to generate missing host keys on normal boots.
+
+The distribution unit must retain its ordering:
+`Before=ssh.service sshd.service sshd@.service`.
+
+Remove host keys during template cleanup, but do not regenerate them
+before saving the template.
+
+## Legacy service
+
+An old `/etc/systemd/system/ssh-keygen.service` may exist.
+Inspect and disable that obsolete unit if present. The supported
+distribution service is `sshd-keygen.service`.
+
+## Verification
+
+    systemctl cat sshd-keygen.service
+    systemctl status sshd-keygen.service
+    journalctl -b -u sshd-keygen.service -u ssh.service
+    journalctl -b -u agent.service -u networking.service
+
+Expected: missing SSH host keys are created before ssh.service starts;
+network configuration may happen later when the agent receives context.
+

misc/configure-ubuntu-systemd.sh

+
+#!/usr/bin/env bash
+set -euo pipefail
+
+# CIRCLE Agent - Ubuntu systemd setup
+#
+# The CIRCLE agent configures networking after receiving VM context
+# from the manager. Do not make networking.service depend on the agent:
+# agent.service is a long-running daemon, not an initialization oneshot.
+#
+# SSH host keys must be generated after cloning a VM template.
+# Ubuntu's sshd-keygen.service normally has ConditionFirstBoot=yes,
+# which does not work for every CIRCLE template clone.
+#
+# Tested setup: Ubuntu 26.04, ifupdown, OpenSSH with systemd.
+
+if [[ $EUID -ne 0 ]]; then
+    echo "Run this script as root." >&2
+    exit 1
+fi
+
+if [[ ! -f /usr/lib/systemd/system/sshd-keygen.service ]]; then
+    echo "sshd-keygen.service not found; inspect OpenSSH installation." >&2
+    exit 1
+fi
+
+mkdir -p /etc/systemd/system/sshd-keygen.service.d
+
+cat > /etc/systemd/system/sshd-keygen.service.d/override.conf <<'EOF'
+[Unit]
+Description=Generate missing SSH host keys
+ConditionFirstBoot=
+ConditionPathIsReadWrite=/etc/ssh
+ConditionPathIsSymbolicLink=!/etc/ssh
+EOF
+
+# Remove an obsolete, locally installed service only if it matches
+# the old CIRCLE template unit. Do not blindly delete arbitrary units.
+if [[ -f /etc/systemd/system/ssh-keygen.service ]]; then
+    echo "NOTE: Legacy /etc/systemd/system/ssh-keygen.service found."
+    echo "Inspect and disable it manually if it is the obsolete unit."
+fi
+
+systemctl daemon-reload
+
+echo
+echo "sshd-keygen.service effective configuration:"
+systemctl cat sshd-keygen.service
+
+echo
+echo "Done. SSH host key generation will no longer require first boot."
+echo "The sshd-keygen service generates only missing keys (ssh-keygen -A)."
+echo "Do NOT generate SSH host keys before saving a reusable VM template."
+