fix: use Popen for sshd restart, match original start_sshd() pattern

entrypoint.py

@@ -168,12 +168,23 @@ def restore():
         log("── RESTORE: no package list")
 
     # Restart sshd to pick up restored host keys
-    sh("pkill -x sshd")
-    time.sleep(0.5)
+    sh("pkill sshd")
+    time.sleep(1)
     os.makedirs("/run/sshd", exist_ok=True)
-    rc, _ = sh(f"/usr/sbin/sshd -o Port={SSH_PORT} -o ListenAddress=127.0.0.1 "
-               f"-o PermitRootLogin=yes -o PasswordAuthentication=yes -o UsePAM=yes")
-    log(f"  sshd restarted {'ok' if rc == 0 else 'FAILED'}")
+    proc = subprocess.Popen([
+        "/usr/sbin/sshd", "-D", "-e",
+        "-o", f"Port={SSH_PORT}",
+        "-o", "ListenAddress=127.0.0.1",
+        "-o", "PermitRootLogin=yes",
+        "-o", "PasswordAuthentication=yes",
+        "-o", "PermitEmptyPasswords=no",
+        "-o", "UsePAM=yes",
+    ])
+    time.sleep(0.5)
+    if proc.poll() is None:
+        log(f"  sshd restarted ok PID={proc.pid}")
+    else:
+        log(f"  sshd restart FAILED (exit={proc.poll()})")
 
     # Fix up after restore
     sh('ldconfig 2>/dev/null')