feat(ssh): explicitly confirm changed host key updates

[WilliamWang1721]

Result / 用户结果

Closes #252. When a previously recorded SSH key changes, Pebrel shows the host/port and old/new SHA256 fingerprints with an identity-change warning. Connecting requires explicit confirmation and a successful targeted save; cancel and unattended probes retain the old trust record.

Design / 设计边界

• SSH session owns verification/update; the existing bounded prompt and GPUI confirmation dialog present the decision.
• Reuses ssh-key's known_hosts parser, existing HMAC/hash dependencies and atomic replacement. No new dependency or persistent format.
• Shared hostname lines split only the target; hashed target records retain their hash. Other hosts, ports, algorithms, comments and line endings remain intact.
• Matching revoked/CA records and changed wildcard/negated patterns fail closed. Symlink updates are refused. File snapshots are compared under the application writer lock before replacement; independent OpenSSH writers do not share this lock, so this is not a cross-tool atomic CAS. Rust file permissions are preserved. Windows uses ReplaceFileW with no ACL/merge-error bypass and an original-file backup; it never falls back to a permission-losing rename.

Evidence / 验证依据

• Two source/diff self-reviews completed. No local tests, builds, formatters or architecture checks were executed; Initial architecture/pr-size checks passed; initial format failure was corrected using Actions output. Final source 70539af9da7d8790c51cb7fb628e55a8cd9070db passed all upstream checks and all five native platforms in run 37115546218. The Windows ACL fixture removes inherited PowerShell 7 module paths before launching Windows PowerShell, preserving the strict DACL setup and equality assertion. Windows DACL preservation, locked replacement retention, real loopback SSH confirmation, dialog cancellation and unrelated malformed-key regressions passed. Maintainer/Code Owner approval remains required.
• Added isolated known_hosts regressions for shared lines, hashes, other hosts/ports/algorithms, comments/endings, stale snapshots and protected/pattern records. A real handler regression preserves connection despite unrelated malformed keys/unknown algorithms. Windows regressions compare a target protected DACL with a broader inherited parent and check replacement failure preserves the original.
• Added a real loopback SSH regression: old record rejects connection, cancel keeps rejection, explicit saved update allows connection.
• Added real GPUI cancel-button regression and English/Chinese endpoint/fingerprint formatting coverage. Physical-device/DPI visual acceptance is unverified.

AI implementation/review: GPT-6.1 SOL sub-agents; this CI fixture fix used GPT-6.1 SOL / high. Earlier coordinator model and reasoning efforts unverified.

Required Review / 必须确认

• Followed contribution, architecture and project constraints.
• Responsibilities follow SSH capability and existing prompt ownership.
• Architecture gate passed for the final source without budget changes.
• Success/failure regressions and validation boundaries are stated.
• New text uses typed i18n IDs with matching English/Chinese placeholders and existing fallback.
• No governance rule change.