The old ApproveFingerprint passed the SHA256 fingerprint string to
AddKnownHost which expected authorized_key format, causing known_hosts
entries to be corrupted and subsequent SSH connections (including shutdown)
to fail with "host key not found".
Changes:
- dialSSH now returns (conn, fingerprint, pubKey, error) with the raw
ssh.PublicKey captured from the server
- New ConnectForApproval() wraps dialSSH with strictHostKeyChecking=false
for the approval handshake
- ApproveFingerprint now opens an SSH connection to the host (non-strict),
captures the real public key, and writes it in authorized_keys format
to known_hosts via AddKnownHost
- shutdown.go updated to handle the new 4-value dialSSH return
- Supports optional host_key field in request body for direct key submission
darroyo
50f73cd656