The wasm-opt bench VM cloud-init seed carried a committed console/SSH password
and enabled SSH password auth. setup-vm.sh already requires and injects an SSH
pubkey, so lock the password (lock_passwd: true) and disable SSH password auth
(ssh_pwauth: false).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Tooling that produced the perf findings (committed for rerunnability):
- scripts/bench/wasm-opt-bench.sh + o2-config-sweep.sh + sweep.conf:
replay asyncify/-O2 over a cached fixture under allocator/THP/core
matrices on the Hetzner runner.
- scripts/bench/setup-vm.sh + cloud-init/ + vm-build.sh: local QEMU
(HVF) Ubuntu guest with Docker CE to verify Linux builds without
burning paid runners.
- .gitignore: bench fixtures/results and the VM image stay local.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>