Design Sandcastle SSH host-key trust and agent diagnostics

[thieso2]

What to build

Review and finalize the follow-up design for hostname-based SSH trust and agent-forwarding diagnostics. This should cover Sandcastle-specific known-hosts storage, a trust/refresh command, and preflight behavior for stale host keys without automatically editing global ~/.ssh/known_hosts.

Acceptance criteria

• Decide whether hostname-based SSH should use ~/.sandcastle/known_hosts by default.
• Specify the trust/refresh command shape, such as sandcastle ssh trust [project:]name or sandcastle trust host [project:]name.
• Specify when local and remote ssh-add -l probes should run.
• Specify non-interactive behavior for changed host keys.
• Confirm raw Tailscale IP fallback behavior and host-key validation boundaries.

Blocked by

• Expose primary_dns_name for sandbox connection identity #111