jobs/upgrade: ANSIBLE_HOST_KEY_CHECKING=false