ci(installer): run trusted SSH E2E matrix

internal/installer/harness/integration_activation_test.go

@@ -258,8 +258,11 @@ func TestSourceInstallActivationFailureRollback(t *testing.T) {
 
 	// 1. Build failure preserves the prior install.
 	//    A dirty tracked tree makes the rerun's checkout refuse before
-	//    the build, so neither staging nor the service changes.
-	if _, err := RunCommand(client, "git -C "+shellQuote(res.Plan.BuildDir)+" checkout -q master~1 -- Makefile"); err != nil {
+	//    the build, so neither staging nor the service changes. Appending
+	//    a marker is deterministic regardless of the cloned history (a
+	//    `git checkout master~1 -- <file>` would depend on whether that
+	//    commit differs from the resolved one).
+	if _, err := RunCommand(client, "printf '\\n# rsmon-worker dirty-tree marker\\n' >> "+shellQuote(res.Plan.BuildDir)+"/Makefile"); err != nil {
 		t.Fatalf("dirty the working tree: %v", err)
 	}
 	before := installedBinarySHA(t, client, a)