Fix dstack apply --ssh-identity

[un-def]

• Report a proper error instead of a traceback if the key file does not exist or cannot be parsed
• Generate the public key from the private key if there is no .pub file, as the API docstrings already claimed
• Pass the key to Run.attach(), so that the run SSH config no longer falls back to ~/.dstack/ssh/id_rsa
• Reject public key paths, as SSH tunneling requires a private key

Refactoring and related changes:

• Add the resolve_ssh_key() helper that resolves a private or public key path to key contents and paths, and reuse it in the fleet configurator, which had the same logic inlined
• Look up <key>.pub instead of <key stem>.pub, which resolved to a wrong path for key names with dots
• Add ssh_key_pub to RunCollection.get_run_plan() and apply_configuration() for public keys not stored on disk, mutually exclusive with ssh_identity_file
• dstack fleet: raise CLIError instead of printing an error and exiting with a zero exit code

Fixes: #4190
Co-authored-by: Claude Opus 5 (1M context) noreply@anthropic.com