fix: decrypt SSH keys to tmpdir instead of repo, gitignore ed25519 keys

The decrypt step in provision.sh was writing decrypted private keys
directly into the source tree (system/clearpilot/dev/), leaving them
as untracked files in the repo. Now decrypts to a mktemp dir, copies
to the SSH dir, and cleans up. Also added ed25519 key paths to
.gitignore to match the existing id_rsa entries.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

system/clearpilot/on_start.sh

@@ -14,5 +14,5 @@ nmcli radio wifi on 2>/dev/null
 
 # Provision (packages, git pull, build) if no quick_boot flag
 if [ ! -f /data/quick_boot ]; then
-    bash /data/openpilot/system/clearpilot/provision.sh
+    sudo bash /data/openpilot/system/clearpilot/provision.sh
 fi