chore: refresh encrypted SSH known-hosts source

[xnoto]

Summary

Owner-authorized replacement of the canonical SOPS-encrypted ssh_known_hosts source. The encrypted change is confined to secrets/secrets.yaml; the existing non-secret mapping and recipient list are unchanged.

Owner attestation for this encrypted-only update: the intended operation is replacement of ssh_known_hosts. Commit metadata records three encrypted-file additions and three deletions; ciphertext and plaintext were neither retrieved nor reviewed.

Fixes # N/A

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending opentofu / test and opentofu / plan; PR CI is the validation authority.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; no generated file changed.

Intended plan review: confirm exactly two Actions-secret updates, with no additions, deletions, recipient drift, repository-policy changes, or other infrastructure changes. Never include ciphertext, plaintext, or sensitive plan output in review material.

After merge and the separately environment-gated main apply, rerun the existing check-only hero-host-config workflow with strict SSH host-key verification. A successful SSH verification is the functional validation; cleanup of the local tfroot-libvirt source must not precede it.

Impact and rollout

Producer: tfroot-github remains the canonical encrypted source and GitHub Actions-secret distributor for ssh_known_hosts.

Consumers: the existing mapping updates two recipients atomically after the gated apply:

• SSH_KNOWN_HOSTS in tfroot-libvirt
• HERO_HOST_CONFIG_SSH_KNOWN_HOSTS in hero-host-config

Unchanged: mappings, repository recipients, provider pins, workflows, Cloudflare configuration, SSH private-key source, host configuration, and GitOps desired state.

Delivery stages: authoring and branch publication are complete. PR checks are automatic and pending. Merge and the main apply are separate confirmation gates. Functional Hero SSH verification is a later check-only workflow stage. The tfroot-libvirt cleanup is a separate reviewed change only after source apply and functional verification succeed.

Rollback: before apply, close or revert this PR. After apply, the owner restores the prior encrypted source through a new PR and environment-gated apply; no Actions-secret value is read back. SSH identity rotation is a separate operation.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: the owner authored and pushed the encrypted SOPS update. An OpenCode agent created this PR body from non-secret repository metadata and did not retrieve, decrypt, print, or summarize encrypted secret content.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "hero-host-config:HERO_HOST_CONFIG_SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "tfroot-libvirt:SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "hero-host-config:HERO_HOST_CONFIG_SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "tfroot-libvirt:SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.