feat: enhance known_hosts management with deletion cleanup and SSH cache handling

USAGE.md

@@ -429,6 +429,33 @@ By default, UVM uses SSH `StrictHostKeyChecking=accept-new` and a stable
 host-key alias derived from the VM ID. This lets a guest IP be reused later
 without confusing it with the prior VM's known-hosts entry.
 
+When a VM is deleted, UVM removes its explicit IP and `uvm-<VM-ID>` entries
+from local SSH caches. This also covers direct `ssh user@GUEST_IP` connections
+and hashed hostnames. Plain `[host]:port` entries are removed for the VM;
+hashed port entries are checked for TCP/22 and the ports in the VM's allowlist.
+Other hosts (including other aliases on a shared line), wildcard trust rules,
+comments, and file ownership/mode are preserved. Missing caches are harmless.
+
+The default files are `~/.ssh/known_hosts` and `~/.ssh/known_hosts2` for the
+effective user and, when running under `sudo`, its invoking user. Homes are
+resolved from the local account database. The API uses the user context that
+launched its server. To select specific local files for a service or custom
+SSH configuration, set this variable when launching UVM:
+
+```sh
+export UVM_KNOWN_HOSTS_FILES='/root/.ssh/known_hosts:/home/dgxdev/.ssh/known_hosts'
+# Pass it explicitly through sudo when starting the API or running deletion.
+sudo env UVM_KNOWN_HOSTS_FILES="$UVM_KNOWN_HOSTS_FILES" ./uvm.py delete VM -y
+```
+
+These paths are local to the UVM host. An SSH client on another computer manages
+its own cache there. For a stale entry left by a VM deleted with an older UVM
+version, remove that entry once from the SSH client's account:
+
+```sh
+ssh-keygen -f "$HOME/.ssh/known_hosts" -R '10.42.0.2'
+```
+
 The key must already be authorized by the guest; UVM does not inject it.
 `--port` selects the guest SSH port (default 22), not a host mapping. The
 guest's sshd and private allowlist must allow that port. SSH does not feed the
@@ -519,8 +546,10 @@ sudo ./uvm.py delete web -y
 # Equivalent destructive command: sudo ./uvm.py destroy web -y
 ```
 
-Delete performs the stop cleanup, then removes the runtime directory/private
-disk and registry record, releasing the name and IP. `destroy` is the same
+Delete performs the stop cleanup, removes the runtime directory/private disk,
+cleans matching local SSH host-key entries, then removes the registry record,
+releasing the name and IP. A cache cleanup error retains the pending deletion
+and IP reservation so cleanup can be retried before the IP is reused. `destroy` is the same
 command with the same flags. Back up data first. A failed deletion remains
 pending; retry delete rather than trying to resurrect it with start.
 
@@ -1023,6 +1052,7 @@ automatically detects every conflict with host routes or other managers.
 | `UVM_NETWORK` | Guest subnet; default `10.42.0.0/24` |
 | `UVM_GATEWAY` | Guest gateway / bridge IP; default `10.42.0.1` |
 | `UVM_BRIDGE` | Linux bridge name; default `uvm0` |
+| `UVM_KNOWN_HOSTS_FILES` | Override deletion's local SSH cache files; colon-separated absolute paths |
 | `UVM_KERNEL_URL` | Override the host-architecture default kernel URL |
 | `UVM_ROOTFS_URL` | Override the host-architecture default rootfs URL |
 | `UVM_FIRECRACKER_SHA256` | Strict Firecracker archive checksum |