Pin Athena operator Gitea transport

platform/operator/athena_operatord.py

@@ -77,9 +77,11 @@ def run(argv: list[str], *, cwd: Path = STACK, timeout: int = 900, check: bool =
         "HOME": "/root",
     }
     git_key = Path(os.environ.get("ATHENA_OPERATOR_GIT_SSH_KEY", "/etc/mike-ai/athena-operator-git"))
+    known_hosts = Path(os.environ.get("ATHENA_OPERATOR_GIT_KNOWN_HOSTS", "/etc/mike-ai/athena-operator-known-hosts"))
     if git_key.is_file():
         environment["GIT_SSH_COMMAND"] = (
             f"ssh -i {shlex.quote(str(git_key))} -o IdentitiesOnly=yes "
+            f"-o UserKnownHostsFile={shlex.quote(str(known_hosts))} "
             "-o StrictHostKeyChecking=yes"
         )
     completed = subprocess.run(

platform/operator/install-operator.sh

@@ -12,6 +12,8 @@ if [[ ! -e /etc/mike-ai/athena-operator-git ]]; then
 fi
 chmod 0600 /etc/mike-ai/athena-operator-git
 chmod 0644 /etc/mike-ai/athena-operator-git.pub
+install -m 0644 "$ROOT/config/athena-operator-known-hosts" \
+  /etc/mike-ai/athena-operator-known-hosts
 install -d -m 0750 -o root -g 10003 /run/mike-ai-operator
 install -d -m 0700 /data/mike-ai-operator/state /data/mike-ai-operator/repository
 install -m 0755 "$ROOT/platform/operator/athena_operatord.py" /usr/local/libexec/mike-ai-athena-operatord