Drop IdentitiesOnly/IdentityFile pinning — every box just offers its own default key to the forge; only registered keys authenticate.
Pins git.melonbread.xyz (Forgejo) to port 222 with the machine key only — the forge SSH daemon does not listen on 22. All boxes pushing to the forge need this stanza; known_hosts/authorized_keys stay per-machine and unmanaged.
