[groupsky]

Refs #100

Since OpenSSH 9.8, ssh-keyscan prints its banner comment lines on stdout (openssh-portable commit 1e84d0c, 2024-06-14, first in tag V_9_8_P1; its message says "to stderr", but the code moves the lines from stderr to stdout). So 2>/dev/null kept them, and the awk made them look like host lines.

Changes

• docs/setup.md section 6, step 2: the awk drops lines that start with #. This works with each OpenSSH version. I did not use ssh-keyscan -q: it exists only since 9.8, and older versions fail on it.
• Step 3: compare the number of lines with the number of fingerprints, and a command that shows each line that is not a key.
• Not done: a better broker error (the issue says "maybe"). The doc fix and the count check are enough to meet Done when; this keeps the change small.

Progress

• Section 6 keeps only key lines, whichever stream ssh-keyscan writes its comments to.
• Step 3 would show a line that is not a key.
• The OpenSSH version that writes the comments to stdout is named, with a source.
• Review and security review (review: commit note and sk- keys, fixed; security review: no critical, high or medium findings. Not done: its optional low note to show how to remove a line; any editor works, and the step says to run the check again)
• CI green (lint needed two reruns: GitHub downloads gave HTTP 504)

Checked by hand: a file made with the old awk from a scan with a comment line gives 3 lines and 2 fingerprints, and the new awk command shows line 1; the new step 2 gives 2 and 2.