[codex] Keep known hosts local during sync

[binaricat]

Summary

• Stop including known hosts in cloud sync payloads.
• Ignore legacy cloud known-host data when applying or merging sync snapshots.
• Keep known hosts in local backup and restore flows.
• Add regression tests for cloud payloads, local backups, merge behavior, and shrink protection.

Why

Known hosts are device-local trust records. Syncing them across machines can overwrite local state with records from another device, so cloud sync should leave them alone while still preserving them in local backups.

Related to #859.

Validation

• node --test --import tsx application/syncPayload.test.ts domain/syncMerge.test.ts domain/syncGuards.test.ts
• npm run lint
• npm test
• npm run build