Burn in some SSH host key knowledge

This avoids a prompt at deploy time and the possibility of an MitM attack
against TOFU.

ci-tools/known_hosts.production

+monitoring.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvKv2y+IAL4+oDnX7Cm5G9QuADBHUj9OxzLX0okf6hF
+payments.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBlyFTJyN+VDlzGWANKqBlXeexlX/xTpp6gb5sUlA9U
+storage001.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILQojjGVvmjZfDcrlec8ZmpbzMEeHd4+t4DJq1R/NUXw
+storage002.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKDWqK7FBzT4L1eoIU/iaEZNZxq3Jr613PmK2nbAXFs2
+storage003.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHobJpQVv9GaTv8Xh9CGlL7BL5yKLxCiD3ZDdVTyt0Ep
+storage004.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJy96VEPp617ewxdkt+8ZgWcYkLxlVG/C7bZAq0ULH+z
+storage005.private.storage ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKOgJBoER0lX2Rx8UIfv/3MVJXNFn9RldYmpU+EqAc9H

ci-tools/known_hosts.staging

+monitoring.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINI9kvEBaOMvpWqcFH+6nFvRriBECKB4RFShdPiIMkk9
+payments.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK0eO/01VFwdoZzpclrmu656eaMkE19BaxtDdkkFHMa8
+storage001.privatestorage-staging.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFP8L6OHCxq9XFd8ME8ZrCbmO5dGZDPH8I5dm0AwSGiN

ci-tools/update-grid-servers

@@ -8,6 +8,10 @@
 
 set -euxo pipefail
 
+# Find the location of this script so we can refer to data files with a known
+# relative location.
+HERE=$(dirname $0)
+
 # Get the path to the ssh key which authorizes us to deliver this
 # notification.
 DEPLOY_KEY=$1
@@ -21,13 +25,24 @@ shift
 
 # Tell one server to update itself.
 update_one_node() {
+    grid_name=$1
+    shift
+
     deploy_key=$1
     shift
 
     node=$1
     shift
 
-    ssh -i "${deploy_key}" "deployment@${node}"
+    # Avoid both the "host key unknown" prompt and the possibility for a
+    # man-in-the-middle attack (on every single deploy!) by referring to a
+    # pre-initialized known hosts file for this grid.
+    #
+    # Then use the specified deploy key to authenticate as the deployment user
+    # and trigger the update on the host.  There's no command here because the
+    # deployment key is restricted *only* the deloyment update command and the
+    # ssh server will supply that command itself.
+    ssh -o "UserKnownHostsFile=${HERE}/known_hosts.${grid_name}" -i "${deploy_key}" "deployment@${node}"
 }
 
 # Tell all servers belonging to one grid to update themselves.
@@ -65,7 +80,7 @@ update_grid_nodes() {
 	    # This isn't a server, it's part of the morph configuration.
 	    continue
 	fi
-	update_one_node "${deploy_key}" "${node}.${domain}"
+	update_one_node "${gridname}" "${deploy_key}" "${node}.${domain}"
     done
 }