Reinstating the auto known_hosts entry on first deploy. Clear scope: host trust (TOFU known_hosts entry) is automated — same as 'ssh -o StrictHostKeyChecking=accept-new' would do; identity keypairs (~/.ssh/id_*) are never generated/copied/modified by deploy.sh. PSYC_SKIP_HOST_TRUST=1 disables the auto-trust step if you'd rather verify fingerprints manually. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>