docs: the known_hosts steps keep ssh-keyscan's comment lines on newer OpenSSH #100

What happened

On 2026-10-20, the known_hosts steps of docs/setup.md section 6 were run on a Debian 13 broker host, with the guide's pattern:

ssh-keyscan -t ed25519,ecdsa,rsa HOST 2>/dev/null |
  awk '{print "NAME", $2, $3}' >> /run/nodkey-setup/known_hosts

The broker then refused to start:

config /etc/nodkey/broker.toml: known_hosts: /etc/nodkey/known_hosts: line 1: the key is not valid base64

The ssh-keyscan of that host wrote its banner comment lines (# HOST:22 SSH-2.0-OpenSSH_...) to stdout, not stderr, so 2>/dev/null kept them. The awk turned each one into NAME HOST:22 SSH-2.0-OpenSSH_..., a line that looks like a host line. On the same day, OpenSSH 9.6 on Ubuntu 24.04 wrote no comment to stdout. So this depends on the OpenSSH version.

Step 3 of the guide does not catch it: ssh-keygen -lf skips the bad lines without a word, so the fingerprint list looked right.

Fix

• Keep only the key lines, for example awk '$1 !~ /^#/ {print "NAME", $2, $3}', or filter by key type.
• In step 3, also compare the number of lines of the file with the number of fingerprints.
• Maybe also: make the broker's error say what it found ("the third field is not a key; is this a comment from ssh-keyscan?").

Done when

• Section 6 keeps only key lines, whichever stream ssh-keyscan writes its comments to.
• Step 3 would show a line that is not a key.
• The OpenSSH version that writes the comments to stdout is named, with a source.