fix: preserve SSH config mount in deployment

deploy/docker-compose.ssh.yml

@@ -1,4 +1,4 @@
 services:
   gateway:
-    volumes: !reset
+    volumes: !override
       - ${WORKSPACE_SSH_CONFIG_DIR:?WORKSPACE_SSH_CONFIG_DIR is required}:/root/.ssh:ro

scripts/verify.sh

@@ -29,11 +29,20 @@ export WEB_IMAGE=docker.k1412.top/wuyang/k1412-agent-web:verify
 export RUNTIME_IMAGE=docker.k1412.top/wuyang/k1412-agent-runtime:verify
 export GATEWAY_IMAGE=docker.k1412.top/wuyang/k1412-agent-gateway:verify
 export WORKSPACE_IMAGE=k1412-agent-workspace:test
+export WORKSPACE_SSH_CONFIG_DIR=/tmp/k1412-agent-verify-ssh
+export WORKSPACE_SSH_HOST=verify-workspace-host
 
 docker compose config --quiet
 docker compose \
   -f deploy/docker-compose.yml \
   -f deploy/docker-compose.override.yml \
   config --quiet
+docker compose \
+  -f deploy/docker-compose.yml \
+  -f deploy/docker-compose.override.yml \
+  -f deploy/docker-compose.ssh.yml \
+  config --format json \
+  | .venv/bin/python -c \
+    'import json, sys; config = json.load(sys.stdin); mounts = config["services"]["gateway"]["volumes"]; assert mounts == [{"type": "bind", "source": "/tmp/k1412-agent-verify-ssh", "target": "/root/.ssh", "read_only": True, "bind": {}}], mounts'
 docker build -f docker/workspace.Dockerfile -t k1412-agent-workspace:test .
 RUN_DOCKER_INTEGRATION=1 .venv/bin/pytest tests/test_docker_workspace.py