Worked example and make target for the kvm-ssh Secret

docs/kvm-provider.md walks through key generation, ssh-copy-id,
ssh-keyscan under the address the operator dials, and the Secret from
the private key plus ~/.ssh/kvm_known_hosts. make kvm-ssh-secret runs
the same as an apply with KVM_SSH_KEY / KVM_KNOWN_HOSTS overrides and
refuses a .pub, the classic mistake. README mirrors the short form.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -139,12 +139,16 @@ Managed proxies as VMs on libvirt/KVM hosts you own. Full guide:
 
 1. Each host needs `libvirtd`, an SSH user in the `libvirt` group, a
    bridge to a network with DHCP, and a storage pool.
-2. Create the `kvm-ssh` Secret (private key + `known_hosts`); the manager
-   mounts it at `/etc/proxy-operator/kvm`:
+2. Create the `kvm-ssh` Secret from the operator's **private** key and a
+   `known_hosts` with each host's key; the manager mounts it at
+   `/etc/proxy-operator/kvm`:
 
    ```sh
+   ssh-keyscan -H <host> >> ~/.ssh/kvm_known_hosts
    kubectl -n egress-proxies-operator-system create secret generic kvm-ssh \
-     --from-file=id_ed25519=<key> --from-file=known_hosts=<known_hosts>
+     --from-file=id_ed25519=$HOME/.ssh/proxy-operator_ed25519 \
+     --from-file=known_hosts=$HOME/.ssh/kvm_known_hosts
+   # or: make kvm-ssh-secret   (same paths by default; KVM_SSH_KEY / KVM_KNOWN_HOSTS to override)
    ```
 
 3. Add a `kvm` entry to the providers config with `images`,