SSH config writes are not idempotent, and tests write fixture hosts into the user's real ~/.ssh/config (164 duplicate blocks observed)

## Summary

`clustrix` appends entries to the user's **real** `~/.ssh/config` without deduplicating, and it writes **test-fixture hosts** into that personal config. On my machine this accumulated to 164 identical placeholder blocks.

## Evidence

Measured on a real user config (macOS, `~/.ssh/config`):

```
total lines: 1202
total Host entries: 172
```

Frequency by host (real hostnames redacted):

```
164 Host my_cluster <- test fixture, repeated 164x
1 Host
1 Host
1 Host test_cli
1 Host test_cleanup
1 Host
1 Host
1 Host
1 Host
```

Every duplicate block is byte-identical and self-labelled:

```
# Clustrix auto-generated entry for my_cluster
Host my_cluster
HostName cluster.example.com
User testuser
IdentityFile ~/.ssh/id_ed25519_clustrix_testuser_my_cluster
IdentitiesOnly yes
```

`cluster.example.com` / `testuser` is a **test fixture**, not a real host. After removing only the `my_cluster` blocks, the file went from **1202 lines / 172 Host entries to 52 lines / 8 Host entries**, with every genuine entry preserved.

## Two distinct bugs

1. **No deduplication on write.** Each run appends a new block for a host that already has one. Nothing detects or replaces the existing entry, so the file grows without bound across runs.
2. **Tests write to the real user config.** `my_cluster` → `cluster.example.com` / `testuser` is fixture data. A test suite should never mutate `~/.ssh/config`; it should write to a temp file and point SSH at it via `-F` / `ssh_config` path injection.

## Impact

- The user's personal SSH config becomes unmanageable (1202 lines of which ~96% is generated noise).
- Real entries get buried among fixtures, making the file hard to audit.
- Functionally the duplicates are inert — OpenSSH takes the first match for a given `Host` pattern — so this is a hygiene and trust problem rather than a broken-connection problem. But it means clustrix silently rewrites a security-relevant file in the user's home directory.

## Suggested fixes

- Make config writes **idempotent**: look for an existing block for the same `Host` alias and replace it in place, rather than appending.
- Delimit generated regions with explicit markers (e.g. `# >>> clustrix managed >>>` / `# <<< clustrix managed <<<`) so the tool can rewrite only its own section and users can see what it owns.
- Consider writing to a dedicated `~/.ssh/clustrix_config` and having users add a single `Include clustrix_config` line, so clustrix never touches the main file.
- In the test suite, redirect all SSH-config writes to a `tmp_path` fixture. No test should be able to modify `~/.ssh/config`.
- Optionally ship a `clustrix ssh-config --prune` command to clean up configs already affected.

## Environment

- clustrix installed from source (repo `master`)
- macOS, OpenSSH client

Repérer le chemin d’écriture de la configuration SSH et les tests qui créent le fixture my_cluster ; vérifier d’abord quels tests peuvent accéder à ~/.ssh/config. C’est terminé lorsque des écritures répétées ne créent pas de blocs d’hôtes en double, que les entrées générées sont isolées de manière sûre ou peuvent être remplacées, et que les tests utilisent une configuration temporaire tout en préservant les entrées réelles de l’utilisateur.

Rédigé par le modèle d'indexation à partir du texte de l'issue.