fix(ssh): switch CI SSH to permissive mode (no known_hosts)

Root cause: ssh-keygen -R prints 'Host X not found in F:\CI\State\known_hosts'
to stderr when the IP has no prior entry. In PS5.1 with ErrorActionPreference=Stop,
native stderr is converted to ErrorRecords before 2>$null can discard them,
making the command a terminating error caught by the job's catch block.

This caused all 4 concurrent burn-in jobs to fail after ~15s with:
  Error: Host 192.168.79.XXX not found in F:\CI\State\known_hosts

Additionally, 4 concurrent SSH connections writing to the same known_hosts file
with no advisory locking risk file corruption under concurrent load.

Fix: set SshKnownHostsFile default to '' in Invoke-CIJob, Invoke-RemoteBuild,
and Get-BuildArtifacts. When KnownHostsFile='' _Transport.psm1 uses
StrictHostKeyChecking=no + UserKnownHostsFile=NUL (permissive mode), consistent
with Wait-VMReady and Prepare-LinuxBuild2404.ps1. Ephemeral CI VMs on a
local NAT network have no meaningful MITM risk.

Remove the ssh-keygen purge block from Invoke-CIJob.ps1 (no longer needed).

AGENTS.md: document PS5.1 native stderr / 2>$null interaction (error #12).

scripts/Invoke-RemoteBuild.ps1

@@ -141,8 +141,8 @@ param(
     [string] $SshUser = 'ci_build',
 
     # Persistent known_hosts file for SSH calls (CI jobs).
-    # Pass an empty string to disable host-key checking (template provisioning only).
-    [string] $SshKnownHostsFile = 'F:\CI\State\known_hosts',
+    # Empty string (default) = permissive mode (StrictHostKeyChecking=no, UserKnownHostsFile=NUL).
+    [string] $SshKnownHostsFile = '',
 
     # Work directory inside the Linux guest.
     [string] $GuestLinuxWorkDir = '/opt/ci/build',