Devices: make the pin folder before ssh saves a first-seen key into it

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

tests/test_link.py

@@ -155,6 +155,7 @@ class Connecting(unittest.TestCase):
         self.assertIn(f"Port={self.port}", opts)
         master = [c for c in self.calls() if "ControlMaster=yes" in c][-1]
         self.assertIn("StrictHostKeyChecking=accept-new", master)  # first connection: nothing pinned yet
+        self.assertTrue(fd.known_hosts(d["id"]).parent.is_dir())  # where ssh saves the key it accepts
         # It learned: localhost works on this network.
         learned = {a["host"]: a for a in self.reg.get(d["id"])["addresses"]}
         self.assertEqual(learned["localhost"]["networks"], ["n-test"])

ui/frame_link.py

@@ -666,8 +666,11 @@ class Link:
                 extra = ["-o", "StrictHostKeyChecking=yes"]
             else:
                 # First connection since this headset was added: trust what it shows
-                # (as Set Up Connection does), and pin it from now on.
+                # (as Set Up Connection does), and pin it from now on. ssh won't create
+                # the folder its known_hosts file goes in.
                 extra = ["-o", "StrictHostKeyChecking=accept-new"]
+                pins = frame_devices.known_hosts(device["id"]).parent
+                pins.mkdir(**({} if frame_host.WINDOWS else {"mode": 0o700}), parents=True, exist_ok=True)
         if self.control:
             # No ConnectTimeout: with it, OpenSSH's master takes ~5s to open its socket.
             argv = [*self.mux_base, *opts, *extra, "-v", "-o", "ControlMaster=yes", "-o", "ServerAliveInterval=5",