The real cause of 'Permission denied (publickey)': initramfs/init overwrote /etc/passwd at boot with a truncated 4-field entry (root:x:0:root) for seatd — no home, no shell — so dropbear could not resolve root's home and never found /root/.ssh/authorized_keys (this clobbered both the docker-build baked passwd AND the earlier /root fix). Write a full 7-field entry root:x:0:0:root:/root:/bin/sh.