fix(ci): preserve ssh mcp known hosts [skip ci]

.agents/skills/04-awoooi-devops-commander.md

@@ -1235,9 +1235,9 @@ links = DeepLinking.get_all_links(
 |------|-------|------|
 | Dockerfile | `openssh-client` | 生產 stage 必須安裝，ssh binary 才存在 |
 | K8s Pod securityContext | `fsGroup: 1000` | 讓 appuser 有 group read on 0400 Secret |
-| NetworkPolicy egress | port 22 → 110 + 188 | 預設拒絕，必須明確開放 |
+| NetworkPolicy egress | port 22 → 110/120/121/188 | 預設拒絕，必須明確開放 |
 | Secret defaultMode | `0400` (八進位) | SSH 要求 owner-only，group read 靠 fsGroup |
-| known_hosts Secret | `awoooi-repair-known-hosts` | optional: true，含 110+188 hashed 指紋 |
+| known_hosts Secret | `awoooi-repair-known-hosts` + `ssh-mcp-key.known_hosts` | optional: true，含 110/120/121/188 指紋；`ssh-mcp-key` 給 asyncssh 使用 |
 
 ### repair-bot 白名單 (當前完整清單)
 
@@ -1277,7 +1277,7 @@ links = DeepLinking.get_all_links(
 
 1. 在目標主機建立 `~/bin/repair-bot-{host}.sh`（複製模板）
 2. 將 `awoooi-repair-ssh-key.pub` 加入 `~/.ssh/authorized_keys`（加 `command=` 限制）
-3. `ssh-keyscan -H {host_ip}` → 更新 `awoooi-repair-known-hosts` Secret
+3. `ssh-keyscan {host_ip}` → 更新 `awoooi-repair-known-hosts` Secret 與 `ssh-mcp-key.known_hosts`
 4. NetworkPolicy 新增 `{host_ip}:22` egress
 5. `LAYER_SSH_CONFIG` 新增 layer 設定（`host_repair_agent.py`）
 6. service-registry.yaml 新增服務分級
@@ -1291,8 +1291,8 @@ links = DeepLinking.get_all_links(
 ❌ kubectl apply 06-deployment-api.yaml → IMAGE_TAG_PLACEHOLDER 覆蓋真實 SHA → ImagePullBackOff
 ✅ 修改 K8s Deployment 配置用 kubectl patch，不用 kubectl apply
 
-❌ known_hosts hashed 格式，grep IP 會得 0 → 以為沒寫進去
-✅ 用 wc -l 或 ssh 實測驗證，hashed 格式是正常的
+❌ ssh-mcp-key known_hosts 是空檔或只更新 Secret 未重啟 subPath pod → asyncssh `Host key is not trusted`
+✅ 用 `wc -c /etc/ssh-mcp/known_hosts` 驗證非 0；subPath 掛載更新後 rollout restart API/worker
 
 ❌ StrictHostKeyChecking=no（舊設定）
 ✅ known_hosts Secret 已建立，改用 StrictHostKeyChecking=yes

.agents/skills/05-awoooi-sre-qa.md

@@ -785,6 +785,7 @@ kubectl -n awoooi-prod logs -l app=awoooi-api --tail=50 | \
 | `ssh: command not found` | Dockerfile 缺 openssh-client | Pod exec `which ssh` |
 | `Permission denied (publickey)` | known_hosts 缺少該主機 | Pod exec SSH 看錯誤訊息 |
 | `Permission denied (publickey)` only on `192.168.0.188` | 188 需要 `ollama` 使用者，不是預設 `wooo` | 查 `SSH_MCP_HOST_USERS=192.168.0.188=ollama`，用 `ollama@192.168.0.188` 測 |
+| `Host key is not trusted for host ...` | `/etc/ssh-mcp/known_hosts` 空檔、過期，或 Secret 已 patch 但 subPath pod 未重啟 | patch `ssh-mcp-key.known_hosts`，rollout restart API/worker，再用 `ssh_diagnose` 驗證 |
 | `Load key ... Permission denied` | fsGroup 未設定 | Pod exec `ls -la /etc/repair-ssh/` |
 | `Connection refused/timeout` | NetworkPolicy 封鎖 22 | Pod exec `ssh -v` 看連線過程 |
 | `forbidden_shell_metachar` 且 action 是 `ssh ... '...'` | host/backup category 沒在 DecisionManager kubectl parser 前路由 SSH | 查 `alert_category` 是否為 `backup_failure`，確認 `_is_host_layer_ssh_category()` 覆蓋 |