fix: remove insecure StrictHostKeyChecking from SSH documentation example

[Copilot]

Description

Removed -o StrictHostKeyChecking=no from the SSH connection example in the scripts README, which disabled host key verification and allowed trivial man-in-the-middle attacks.

Changes:

• Removed insecure StrictHostKeyChecking=no option from SSH example command
• Added fingerprint verification step using ssh-keyscan and ssh-keygen -lf
• Added "Host Key Management" section documenting three secure approaches:
  1. Pre-distribute known host keys via secure channels
  2. Verify fingerprints manually on first connection
  3. Use ssh-keyscan with out-of-band fingerprint verification
• Clarified that trusted fingerprints must be obtained through secure channels (VM console logs, control plane API, secure config management)

Before:

ssh -i /tmp/sandbox_key \
    -o CertificateFile=/tmp/sandbox_key-cert.pub \
    -o StrictHostKeyChecking=no \
    sandbox@192.168.122.x

After:

# Verify and accept the host key
ssh-keyscan 192.168.122.x > /tmp/vm_host_key
ssh-keygen -lf /tmp/vm_host_key  # Compare with trusted fingerprint
# Only proceed if fingerprints match!
cat /tmp/vm_host_key >> ~/.ssh/known_hosts

# Connect
ssh -i /tmp/sandbox_key \
    -o CertificateFile=/tmp/sandbox_key-cert.pub \
    sandbox@192.168.122.x

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Code style update (formatting, renaming)
• Code refactor (no functional changes)
• Configuration change
• Test update

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works

Release Notes

Fixed security vulnerability in SSH documentation example by removing StrictHostKeyChecking=no and adding proper host key verification guidance.

Labels

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[aspectrr]

lgtm