fix(ci): preserve ssh mcp known hosts [skip ci]

docs/adr/ADR-058-host-auto-repair-ssh-whitelist.md

@@ -171,6 +171,9 @@ MoWoooWorkDown → Jaccard 匹配 momo-app-down-repair → SSH ollama@192.168.0.
   - `ollama@192.168.0.188`
 - Runtime config:
   - `SSH_MCP_HOST_USERS=192.168.0.188=ollama`
+- Runtime known_hosts:
+  - `ssh-mcp-key.data.known_hosts` must be non-empty and mounted at `/etc/ssh-mcp/known_hosts`
+  - Because the file is mounted with `subPath`, updating the Secret requires rolling API/worker pods before asyncssh sees the new trust store
 - NetworkPolicy egress:
   - `192.168.0.110:22`
   - `192.168.0.120:22`