Using RuntimeDirectory in ssh.service and ssh@.service creates the
needed directory /run/sshd but there are issues in two cases:

1. After switching from ssh.socket to ssh.service while a ssh
   connection is open, results in future logins to fail.
   Closing the existing ssh.socket connection let systemd to remove
   /run/sshd despite ssh.service already running. Subsequent logins
   fail as it has no runtime directory anymore.
   This is especially bad as it will lock an administrator out.
   Even testing logins before closing the last connection does not
   highlight this issue.
   SSH login works again after the directory is created manually or
   the host or service is restarted (directory is recreated by ssh).

2. Testing sshd configuration (using `sshd -t`) while neither
   ssh.service or ssh@.service are running fails. It complains that
   the privilege separation directory /run/sshd does not exist.

I tried different things:

- Adding RuntimeDirectoryPreserve=yes to ssh@.service to ensure the
  directory is kept. This address case one but `sshd -t` still
  fails until ssh.service is started or a connection has been
  established. Otherwise systemd has not yet created the directory.

- Using tempfiles.d to create the directory on system boot.

Combining both might work to create the directory in just every case.