Improve error wrapping in tbot identity service

[strideynet]

@webvictim ran into a fairly non-descript error recently:

tbot[3906116]: 2025-12-09T10:47:57.963-04:00 WARN [TBOT:SVC:] Task failed. Backing off and retrying attempt:3 retry_limit:5 backoff:2.781922502s error:[
tbot[3906116]: ERROR REPORT:
tbot[3906116]: Original Error: syscall.Errno permission denied
tbot[3906116]: Stack Trace: ...
tbot[3906116]: User Message: permission denied] internal/loop.go:172

The root cause being that the known_hosts file was owned by another user. I took a look and it turns out that in some of these older code paths, we've really not done a good job of wrapping errors.

After my changes, it looks a little more like:

ERROR REPORT:
Original Error: *trace.AccessDeniedError open /Users/noah/code/gravitational/teleport-scratch/tbot/workload-identity/identity/known_hosts: permission denied
Stack Trace: ...
User Message: rendering OpenSSH config
        writing known_hosts to destination
                reading "/Users/noah/code/gravitational/teleport-scratch/tbot/workload-identity/identity/known_hosts"
                        open /Users/noah/code/gravitational/teleport-scratch/tbot/workload-identity/identity/known_hosts: permission denied] internal/loop.go:172

changelog: Improved detail of error messages for identity service in tbot

[backport-bot-workflows]

@strideynet See the table below for backport results.

Branch	Result
branch/v17	Create PR
branch/v18	Create PR