the problem is there is no other user than root, and as root ssh with a password is disabled (in fact ssh is disabled) you can only login via the serial console or hdmi+keyboard. almalinux is the root password though. not very useful for headless.
i worked around it by injecting a root ssh key into the sdcard’s /root/.ssh/authorized_keys, but you have to do it on a machine that understands selinux (don’t mount it on a debian box like i did!) or create /.autorelabel on the ext4 partition of the sdcard and an empty /boot/ssh on the vfat partition file to enable ssh.
seems sub-optimal to me. really needs to be a non-root user who can ssh and use sudo and have ssh enabled by default, but the rpi foundation found that too many new users were getting pwned.