move SSH setup to on_start.sh, runs unconditionally before provision

SSH keys and sshd start immediately on every boot, not gated behind
quick_boot or dongle check. Provision script only handles packages,
git pull, and build.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

system/clearpilot/on_start.sh

@@ -3,9 +3,16 @@
 # Install logo
 bash /data/openpilot/system/clearpilot/startup_logo/set_logo.sh
 
+# SSH — always, unconditionally, first thing
+cat /data/openpilot/system/clearpilot/dev/GithubSshKeys > /data/params/d/GithubSshKeys
+echo -n 1 > /data/params/d/SshEnabled
+sudo systemctl enable ssh 2>/dev/null
+sudo systemctl start ssh
+
 # Always ensure WiFi radio is on
 nmcli radio wifi on 2>/dev/null
 
+# Provision (packages, git pull, build) if no quick_boot flag
 if [ ! -f /data/quick_boot ]; then
     /data/openpilot/system/clearpilot/tools/qt_shell "/data/openpilot/system/clearpilot/provision_wrapper.sh" --title="ClearPilot Provision"
 fi

system/clearpilot/provision.sh

@@ -2,28 +2,11 @@
 
 # ClearPilot provision script
 # Runs on first boot (no /data/quick_boot) when internet is available.
-# Sets up SSH, installs packages, pulls latest code, and builds.
+# Installs packages, pulls latest code, and builds.
+# SSH is handled by on_start.sh before this runs.
 # Output is displayed on screen via qt_shell.
 
-# Dongle gate
-dongle_id=$(cat /data/params/d/DongleId 2>/dev/null)
-if [[ ! $dongle_id == 90bb71* ]]; then
-    echo "Dongle ID not recognized, skipping provision"
-    sleep 3
-    exit 0
-fi
-
-echo "Dongle ID: $dongle_id"
-
-# 1. SSH
-echo "Setting up SSH authorized keys..."
-cat /data/openpilot/system/clearpilot/dev/GithubSshKeys > /data/params/d/GithubSshKeys
-echo -n 1 > /data/params/d/SshEnabled
-sudo systemctl enable ssh 2>/dev/null
-sudo systemctl start ssh
-echo "SSH enabled and started"
-
-# 2. Wait for internet connectivity
+# 1. Wait for internet connectivity
 echo "Waiting for internet connectivity (up to 30s)..."
 ONLINE=0
 for i in $(seq 1 30); do