chore: refresh Hero SSH known-hosts source

[xnoto]

Summary

Owner-authorized replacement of the canonical encrypted ssh_known_hosts source after trusted out-of-band host-key verification. This branch changes only secrets/secrets.yaml; recipient mappings and workflow code are unchanged.

Owner attestation: the intended operation is replacement of the canonical ssh_known_hosts value while preserving SOPS recipient metadata. Commit metadata records three encrypted-file additions and three deletions. Ciphertext and plaintext were not retrieved, reviewed, or included here.

Fixes # N/A

Type of change

• Bug fix
• Feature / enhancement
• Documentation
• Infrastructure (OpenTofu root or module)
• GitOps desired state (manifests, kustomize, charts, SOPS/KSOPS secrets)
• Container image
• CI / reusable workflow
• Refactor / cleanup
• Breaking change

Validation

• Required pull-request checks pass — pending opentofu / test and opentofu / plan; PR CI is the validation authority.
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited — not applicable; no generated file changed.

Required plan review: confirm only the two existing Actions-secret instances are updated, with no recipient, repository-policy, provider, workflow, or other infrastructure drift. Do not include ciphertext, plaintext, credentials, private endpoints, raw logs, or sensitive plan output in review material.

After merge and the separately environment-gated main apply, dispatch hero-host-config's existing check-only workflow from main. It must pass while retaining UserKnownHostsFile and StrictHostKeyChecking=yes; it is the functional gate before any tfroot-libvirt cleanup.

Impact and rollout

Producer: tfroot-github remains the canonical encrypted source and Actions-secret distributor for ssh_known_hosts.

Consumers: the existing mapping updates both consumers atomically after the gated apply:

• HERO_HOST_CONFIG_SSH_KNOWN_HOSTS in hero-host-config
• SSH_KNOWN_HOSTS in tfroot-libvirt

Unchanged: SOPS lookup/mapping code, recipients, provider pins, reusable workflow selection, Cloudflare configuration, SSH private-key sources, host configuration, GitOps desired state, and host mutation behavior.

Delivery stages: encrypted source authored and branch-published. PR test/plan are automatic and pending. Merge and main apply are separate confirmation gates. The WARP-routed, strict-SSH check-only workflow is a further manual confirmation-gated functional test. The deprecated tfroot-libvirt cleanup remains separately reviewed and prohibited until that test passes.

Rollback: before apply, close or revert this PR. After apply, restore a prior owner-validated encrypted source through a new PR and environment-gated apply; Actions secrets are not read back. Do not revert a compromised host key without an explicit owner security decision.

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints.
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks.
• Breaking or irreversible effects are described above with rollback notes.

AI-assisted change: the owner authored and pushed the encrypted SOPS update. An OpenCode agent prepared this PR from non-secret metadata only; it did not retrieve, decrypt, print, or summarize encrypted secret content.

[github-actions]

OpenTofu Test

OpenTofu test passed.

View the workflow run.

View run output

Terraform validate.......................................................Passed
Terraform validate with tflint...........................................Passed
Checkov..................................................................Passed
Terraform fmt............................................................Passed
Terraform docs...........................................................Passed
Detect hardcoded secrets.................................................Passed
check for case conflicts.................................................Passed
check for merge conflicts................................................Passed
check for broken symlinks............................(no files to check)Skipped
check vcs permalinks.....................................................Passed
detect destroyed symlinks................................................Passed
detect private key.......................................................Passed
fix end of files.........................................................Passed
mixed line ending........................................................Passed
trim trailing whitespace.................................................Passed
don't commit to branch..................................................Skipped
check for added large files..............................................Passed

[github-actions]

OpenTofu Plan

OpenTofu plan passed.

View the workflow run.

View run output

OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "hero-host-config:HERO_HOST_CONFIG_SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "tfroot-libvirt:SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.
OpenTofu will perform the following actions:

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "hero-host-config:HERO_HOST_CONFIG_SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (7 unchanged attributes hidden)
    }

[REDACTED: potentially sensitive plan output]
[REDACTED: potentially sensitive plan output]
        id                = "tfroot-libvirt:SSH_KNOWN_HOSTS"
      ~ plaintext_value   = (sensitive value)
        # (8 unchanged attributes hidden)
    }

Plan: 0 to add, 2 to change, 0 to destroy.