Replace known hosts from input

[AgentGoose32]

Summary

• replace the runner known_hosts file with the provided known-hosts input instead of appending to any existing entries
• keeps permissions at 0600
• rebuilds the bundled action output

This makes the input behave as an explicit known-hosts override, so stale runner fingerprints do not remain ahead of the supplied values.

Validation

• npm run typecheck
• npm run build
• git diff --check

Fixes #62

[antonmedv]

But why?

[AgentGoose32]

The issue reporter's failure mode was a stale/incorrect runner entry winning over the known-hosts input. If the action appends, the supplied value is not really an override and users cannot reliably replace a changed host key from workflow config alone.

That said, if your intended behavior is additive trust instead of explicit replacement, this PR may not be the direction you want. I can adjust docs/wording or close it if append semantics are preferred.