fix(linux): purge stale known_hosts entry before first SSH on each clone

Each Linux BuildVM clone gets a new SSH host key for the same
NAT IP, causing 'host key has changed' errors with accept-new mode.

After IP detection, ssh-keygen -R removes the old entry from the
CI-local known_hosts file (F:\CI\State\known_hosts by default)
before Phase 4/5 make any SSH connection. The file is created if
it does not exist yet. Windows jobs are unaffected.

scripts/Invoke-CIJob.ps1

@@ -438,6 +438,20 @@ try {
             Write-Host "[Invoke-CIJob] Could not detect GuestOS from VMX — defaulting to Windows"
         }
     }
+    # ── Purge stale known_hosts entry for this IP (Linux only) ───────────
+    # Each clone gets a new SSH host key. Remove any previous entry for this
+    # IP from the CI-local known_hosts file before the first SSH connection,
+    # so ssh.exe uses accept-new instead of refusing a changed key.
+    if ($GuestOS -eq 'Linux' -and $SshKnownHostsFile -ne '') {
+        $khDir = Split-Path $SshKnownHostsFile -Parent
+        if (-not (Test-Path $khDir)) {
+            New-Item -ItemType Directory -Path $khDir -Force | Out-Null
+        }
+        if (Test-Path $SshKnownHostsFile) {
+            & ssh-keygen -R $VMIPAddress -f $SshKnownHostsFile 2>$null | Out-Null
+            Write-Host "[Invoke-CIJob] Purged known_hosts entry for $VMIPAddress (fresh clone)."
+        }
+    }
     # ── Phase 4: Wait for readiness ───────────────────────────────────────
     Write-Host "`n[Phase 4/6] Waiting for VM readiness..."
     Write-JobEvent -Phase 'phase4.wait-ready' -Status 'start' -Data @{ ip = $VMIPAddress }