Fix known_hosts format: use ssh.MarshalAuthorizedKey

Bug: AddKnownHost wrote raw SSH wire-protocol bytes directly to
known_hosts instead of the OpenSSH authorized-key one-line format.
This produced garbage entries that would break SSH verification
for newly added machines.

Fix: ssh.ParsePublicKey(keyData) + ssh.MarshalAuthorizedKey() to
produce canonical hostkey lines: hostname ssh-ed25519 AAAAB3...xn3c=

internal/sshmanager/knownhosts.go

@@ -6,6 +6,8 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+
+	"golang.org/x/crypto/ssh"
 )
 
 type KnownHost struct {
@@ -38,7 +40,11 @@ func AddKnownHost(sshDir, host string, port int, keyData []byte) error {
 		addr = fmt.Sprintf("[%s]:%d", host, port)
 	}
 
-	line := fmt.Sprintf("%s %s\n", addr, strings.TrimSpace(string(keyData)))
+	pubKey, err := ssh.ParsePublicKey(keyData)
+	if err != nil {
+		return fmt.Errorf("parsing host key: %w", err)
+	}
+	line := fmt.Sprintf("%s %s\n", addr, strings.TrimSpace(string(ssh.MarshalAuthorizedKey(pubKey))))
 	if _, err := f.WriteString(line); err != nil {
 		return err
 	}