bench VM: use SSH key auth only, drop the shared password

The wasm-opt bench VM cloud-init seed carried a committed console/SSH password
and enabled SSH password auth. setup-vm.sh already requires and injects an SSH
pubkey, so lock the password (lock_passwd: true) and disable SSH password auth
(ssh_pwauth: false).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/bench/cloud-init/user-data

@@ -6,12 +6,14 @@ users:
   - name: bench
     sudo: "ALL=(ALL) NOPASSWD:ALL"
     shell: /bin/bash
-    lock_passwd: false
-    # Fallback console/SSH password (key auth is preferred). Change if you care.
-    plain_text_passwd: bench
+    # Key auth only: setup-vm.sh requires an SSH pubkey and substitutes it below,
+    # so no password login is needed. Lock the password and disable SSH password
+    # auth (below); recover via the substituted key, not a shared password.
+    lock_passwd: true
     ssh_authorized_keys:
       - __SSH_PUBKEY__
-ssh_pwauth: true
+# Disable SSH password authentication — the seed carries a pubkey.
+ssh_pwauth: false
 package_update: true
 # Docker CE from the official repo (mirrors the CI workflow's install step) so
 # scripts/bench/vm-build.sh can run the full docker/build.sh pipeline in-guest.