fix(ci): ssh-keyscan failure no longer fails the deploy

ssh-keyscan was being called with set -e in effect and stderr suppressed,
so a single keyscan failure killed the entire deploy with no diagnostic
output. Since rsync/ssh use StrictHostKeyChecking=no, the known_hosts
entry is not load-bearing — making the keyscan best-effort is safe.
stderr is now captured to /tmp/keyscan.err and emitted as a warning so
future failures are debuggable.

Agent-Session: cowork-deploy-fix-20260414

.github/workflows/deploy.yml

@@ -45,7 +45,12 @@ jobs:
           mkdir -p ~/.ssh
           echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/deploy_key
           chmod 600 ~/.ssh/deploy_key
-          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/dev/null
+          # Best-effort: keyscan stderr captured for diagnosis but never fatal.
+          # We use StrictHostKeyChecking=no on the actual ssh/rsync calls anyway.
+          ssh-keyscan -p ${{ secrets.SSH_PORT }} ${{ secrets.SSH_HOST }} >> ~/.ssh/known_hosts 2>/tmp/keyscan.err || {
+            echo "::warning::ssh-keyscan failed (non-fatal). stderr:"
+            cat /tmp/keyscan.err || true
+          }
 
       - name: Deploy via rsync
         run: |