#1740 fix(k3s): scp kubeconfig as ubuntu user on kyber

Summary

Galactica's local user is shunkakinoki, kyber's is ubuntu. After #1738 / #1739 landed galactica's pubkey in kyber's ~ubuntu/.ssh/authorized_keys (correct - that's the home-manager target user on kyber), but activate-client.sh still scp'd as galactica's local username and got Permission denied (publickey).

Verified end-to-end on galactica with this branch: bash config/k3s/activate-client.sh now logs kubeconfig synced from ubuntu@kyber.tail950b36.ts.net and writes the file.

There's a separate unrelated issue with the kubeconfig still containing https://127.0.0.1:6443 (server-side sed rewrite in activate.sh doesn't seem to have run) and a stale TLS cert that needs regen on kyber - both deferred from this PR per request.

Test plan

• shellspec spec/activate_k3s_client_spec.sh -> 10 examples, 0 failures
• shellcheck config/k3s/activate-client.sh clean
• Live run on galactica: sync succeeds with the new username

---

Summary by cubic

Fix k3s client kubeconfig sync by scp'ing as ubuntu@kyber.tail950b36.ts.net. This matches the authorized_keys user and resolves Permission denied (publickey).

• Bug Fixes
  • Set REMOTE_HOST to ubuntu@kyber.tail950b36.ts.net in activate-client.sh.
  • Added a spec to assert the script connects as the ubuntu user.