Phase 7a: use the n8n SSH node (Execute Command is disabled in n8n 2.x)

n8n 2.x disables n8n-nodes-base.executeCommand by default (nodes.exclude), so the
first workflow shape could not activate: 'Unrecognized node type'. Replace the
Execute Command node with the SSH node, which is enabled, and keep the restricted
trigger key: the server forced command runs exactly scripts/morning-brief.sh.

- deploy/n8n-morning-brief.json: schedule + optional manual trigger -> SSH node
  -> Code check that makes a non-zero exit red (FR-12).
- deploy/import-n8n-morning-brief.sh: builds the sshPrivateKey credential from the
  key (id schoolScanKey, mode-0600 temp, removed after import), imports, publishes,
  restarts once, and confirms activation in the n8n log.
- scripts/morning-brief.sh: default IMAGE 0.6.1-phase8 so the scheduled job uses
  the deployed image.
- docs/phase-7a-n8n-schedule.md, deploy/DEPLOYMENT.md: document the design and the
  throwaway-n8n rehearsal (activation + success + failure path).

scripts/morning-brief.sh

@@ -22,7 +22,7 @@
 #   scripts/morning-brief.sh --channel email # limit the channels
 #
 # Environment overrides:
-#   IMAGE                image tag                  (default 0.5.0-phase7)
+#   IMAGE                image tag                  (default 0.6.1-phase8)
 #   VOLUME               SQLite volume             (default compass-teams-nhs_compass-teams-nhs-data)
 #   ENV_FILE             service env file          (default environment.d/school-service.env)
 #   SCHOOL_TIMEZONE      family timezone           (default Australia/Sydney)
@@ -31,7 +31,7 @@ set -euo pipefail
 
 REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 
-IMAGE="${IMAGE:-compass-teams-nhs/school:0.5.0-phase7}"
+IMAGE="${IMAGE:-compass-teams-nhs/school:0.6.1-phase8}"
 VOLUME="${VOLUME:-compass-teams-nhs_compass-teams-nhs-data}"
 ENV_FILE="${ENV_FILE:-$REPO_ROOT/environment.d/school-service.env}"
 SCHOOL_TIMEZONE="${SCHOOL_TIMEZONE:-Australia/Sydney}"