fix(ci): preserve ssh mcp known hosts [skip ci]

docs/runbooks/ssh-mcp-setup.md

@@ -61,7 +61,7 @@ ssh-copy-id -i /tmp/ssh-mcp-key.pub wooo@192.168.0.121
 ### 3. 生成 known_hosts
 
 ```bash
-ssh-keyscan -H 192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188 > /tmp/ssh-mcp-known_hosts
+ssh-keyscan 192.168.0.110 192.168.0.120 192.168.0.121 192.168.0.188 > /tmp/ssh-mcp-known_hosts
 ```
 
 ### 4. 建立 K8s Secret
@@ -72,6 +72,10 @@ kubectl create secret generic ssh-mcp-key \
   --from-literal=known_hosts="$(cat /tmp/ssh-mcp-known_hosts)" \
   -n awoooi-prod
 
+# 更新既有 Secret 時，用 merge patch，避免 json add 在 key 狀態漂移時失敗
+kubectl patch secret ssh-mcp-key -n awoooi-prod --type=merge \
+  -p "{\"data\":{\"known_hosts\":\"$(base64 -w 0 /tmp/ssh-mcp-known_hosts)\"}}"
+
 # 清除暫存
 rm /tmp/ssh-mcp-key /tmp/ssh-mcp-key.pub /tmp/ssh-mcp-known_hosts
 ```
@@ -115,6 +119,7 @@ kubectl exec -n awoooi-prod deploy/awoooi-api -- ls -la /run/secrets/ssh_mcp_key
 
 # 確認 known_hosts 掛載
 kubectl exec -n awoooi-prod deploy/awoooi-api -- ls -la /etc/ssh-mcp/known_hosts
+kubectl exec -n awoooi-prod deploy/awoooi-api -- wc -c /etc/ssh-mcp/known_hosts
 
 # 確認 provider 已啟用
 kubectl logs -n awoooi-prod deploy/awoooi-api | grep '"name": "ssh_host"'
@@ -154,6 +159,6 @@ kubectl rollout restart deploy/awoooi-api -n awoooi-prod
 | 症狀 | 原因 | 解決 |
 |------|------|------|
 | `ssh_host` provider enabled=false | SSH_MCP_ENABLED 未設定 | 確認 ConfigMap |
-| known_hosts WARNING | SSH_MCP_KNOWN_HOSTS_FILE 指向空檔 | 確認 Secret 有 known_hosts key |
+| known_hosts WARNING | SSH_MCP_KNOWN_HOSTS_FILE 指向空檔 | 確認 Secret 有 known_hosts key；若用 subPath 掛載，patch 後需 rollout restart API/worker |
 | Connection refused | authorized_keys 未加入公鑰 | 重做步驟 2 |
 | Host key verification failed | known_hosts 過期 | 重做步驟 3+4 |