jobs/upgrade: use export for ANSIBLE_HOST_KEY_CHECKING