ci(installer): run trusted SSH E2E matrix

internal/installer/harness/integration_activation_test.go

@@ -258,8 +258,11 @@ func TestSourceInstallActivationFailureRollback(t *testing.T) {
 
 	// 1. Build failure preserves the prior install.
 	//    A dirty tracked tree makes the rerun's checkout refuse before
-	//    the build, so neither staging nor the service changes.
-	if _, err := RunCommand(client, "git -C "+shellQuote(res.Plan.BuildDir)+" checkout -q master~1 -- Makefile"); err != nil {
+	//    the build, so neither staging nor the service changes. Appending
+	//    a marker is deterministic regardless of the cloned history (a
+	//    `git checkout master~1 -- <file>` would depend on whether that
+	//    commit differs from the resolved one).
+	if _, err := RunCommand(client, "printf '\\n# rsmon-worker dirty-tree marker\\n' >> "+shellQuote(res.Plan.BuildDir)+"/Makefile"); err != nil {
 		t.Fatalf("dirty the working tree: %v", err)
 	}
 	before := installedBinarySHA(t, client, a)

internal/installer/harness/integration_test.go

@@ -466,8 +466,12 @@ func TestSourceInstallDirtyCheckoutPreservesStaging(t *testing.T) {
 	defer client.Close() //nolint:errcheck
 
 	// Dirty a tracked file so the rerun's checkout refuses to proceed.
-	// Makefile differs between master and master~1 (unlike go.mod).
-	if _, err := RunCommand(client, "git -C "+shellQuote(res.Plan.BuildDir)+" checkout -q master~1 -- Makefile"); err != nil {
+	// Appending a marker is deterministic regardless of the cloned history
+	// (a `git checkout master~1 -- <file>` would depend on whether that
+	// commit differs from the resolved one), and an appended line to a
+	// tracked file is always an unstaged modification `git diff --quiet`
+	// catches.
+	if _, err := RunCommand(client, "printf '\\n# rsmon-worker dirty-tree marker\\n' >> "+shellQuote(res.Plan.BuildDir)+"/Makefile"); err != nil {
 		t.Fatalf("dirty the working tree: %v", err)
 	}
 	beforeBinary, err := RunCommand(client, "sha256sum "+shellQuote(res.StageBinary))