docs(sync-host-keys): fix stale host-keys/ references in comments and usage

After the clan vars migration all keys are in vars/per-machine/, not
host-keys/. Update:
- File header: "existing clan var is never overwritten" (not host-keys/ file)
- Header --remove/--regenerate description: mention clan vars as primary
- usage() --remove, --regenerate-all-keys, --dry-run text
- cmd_remove/cmd_regenerate_all empty-guard messages
- README.md vars/per-machine/ row: "all deployed hosts" (not "LXC hosts")

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B2EJ4qTsM5KUqhS5c3GAwx

scripts/secrets/sync-host-keys.sh

@@ -11,17 +11,16 @@
 #   sync-host-keys.sh --regenerate-all-keys Remove and freshly regenerate
 #                                           every locally-managed key.
 #
-# "Generate/register" is idempotent and additive only: an existing
-# host-keys/ file is never touched, and .sops.yaml only ever gains an
-# anchor/alias it doesn't already have -- safe to re-run any time, e.g.
-# right after adding a new host to flake.nix.
+# "Generate/register" is idempotent and additive only: an existing clan
+# var is never overwritten, and .sops.yaml only ever gains an anchor/alias
+# it doesn't already have -- safe to re-run any time, e.g. right after
+# adding a new host to flake.nix.
 #
-# --remove and --regenerate-all-keys only ever operate on anchors that have
-# a corresponding host-keys/<name>_ssh_host_ed25519_key file. Anchors
-# without one (&admin, and any anchor for an already-deployed host whose
-# real /etc/ssh key was registered by hand, e.g. &docker/&server/&nix-cache
-# today) are never listed, removed, or regenerated -- this tooling only
-# ever touches keys it itself manages.
+# --remove and --regenerate-all-keys only ever operate on anchors that
+# have a corresponding clan var (vars/per-machine/<name>/openssh/) or
+# host-keys/ file. Anchors without either (&admin) are never listed,
+# removed, or regenerated -- this tooling only ever touches keys it itself
+# manages.
 set -euo pipefail
 
 repo_root="$(cd "$(dirname "$0")/../.." && pwd)"
@@ -56,13 +55,14 @@ Usage: $0 --all [--dry-run]
   <flake-target>            Same, for just one target (e.g. lxc-server).
                             Reports if it already has one.
   --remove                  Interactively pick one locally-managed key to
-                            remove from .sops.yaml and host-keys/.
+                            remove from .sops.yaml and vars/per-machine/
+                            (or host-keys/ for legacy keys).
   --regenerate-all-keys     Remove every locally-managed key and generate
-                            fresh replacements for every current flake
-                            target. Destructive -- requires typed
+                            fresh clan-var replacements for every current
+                            flake target. Destructive -- requires typed
                             confirmation.
   --dry-run                 Combine with any of the above: print what would
-                            change (host-keys/ files, .sops.yaml anchors and
+                            change (clan vars, .sops.yaml anchors and
                             key_groups, which secrets/*.yaml would be
                             re-encrypted) without touching anything. No keys
                             generated, no files written, no sops calls,
@@ -315,7 +315,7 @@ cmd_remove() {
   local hosts
   mapfile -t hosts < <(locally_managed_hosts)
   if [[ "${#hosts[@]}" -eq 0 ]]; then
-    echo "No locally-managed keys in host-keys/ -- nothing to remove."
+    echo "No locally-managed keys found (checked host-keys/ and vars/per-machine/) -- nothing to remove."
     return
   fi
 
@@ -372,7 +372,7 @@ cmd_regenerate_all() {
   local hosts
   mapfile -t hosts < <(locally_managed_hosts)
   if [[ "${#hosts[@]}" -eq 0 ]]; then
-    echo "No locally-managed keys in host-keys/ -- nothing to regenerate."
+    echo "No locally-managed keys found (checked host-keys/ and vars/per-machine/) -- nothing to regenerate."
     return
   fi