feat: signed releases and a host-side updater for container nodes

CI signs the image digest of each agent and probe release; the panel only
stores and forwards it. Nodes write the manifest to their data directory and
a host updater verifies the signature with a local public key, pulls by
digest, restarts the unit and rolls back when it is unhealthy. The panel can
list releases, ask a node to update and show the reported update state.

backend/shared/Monitor.Protocol/Rpc/MonitorRpc.cs

@@ -13,6 +13,8 @@ public static class MonitorMethods
     public const string TestStatus = "monitor.test.status";
     public const string Event = "monitor.event";
     public const string Host = "monitor.host";
+    public const string UpdateOffer = "monitor.update.offer";
+    public const string UpdateApply = "monitor.update.apply";
 
     // Probe ↔ Agent（点对点会话）
     public const string Clock = "monitor.clock";
@@ -217,6 +219,66 @@ public sealed class PlatformInfo
     public string? BuiltAt { get; set; }
 }
 
+/// <summary>
+/// 面板给节点的更新清单（<c>monitor.update.offer</c>）：<c>manifest</c> 是发布清单的原始文本，<c>signature</c> 是 base64 的签名。
+/// 节点只是把它们原样放进数据目录；验签、拉取、重启都由宿主机上的更新器完成（节点进程不执行任何命令，也不信任清单的内容）。
+/// </summary>
+public sealed class UpdateOfferParams
+{
+    [JsonPropertyName("manifest")]
+    public string Manifest { get; set; } = "";
+
+    [JsonPropertyName("signature")]
+    public string Signature { get; set; } = "";
+}
+
+/// <summary>宿主机更新器已经验证过的可用更新。</summary>
+public sealed class UpdateAvailable
+{
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
+
+    [JsonPropertyName("tag")]
+    public string? Tag { get; set; }
+
+    [JsonPropertyName("digest")]
+    public string? Digest { get; set; }
+
+    [JsonPropertyName("seq")]
+    public long Seq { get; set; }
+}
+
+/// <summary>
+/// 宿主机更新器的状态（它写在 <c>update-status/status.json</c>，节点读出来随心跳上报）：
+/// <c>up_to_date</c>、<c>available</c>、<c>applying</c>、<c>failed</c>、<c>rolled_back</c>、<c>invalid</c>（清单验签或校验没过）。
+/// 没有安装更新器的节点没有这个字段。
+/// </summary>
+public sealed class UpdateStatus
+{
+    [JsonPropertyName("state")]
+    public string State { get; set; } = "";
+
+    /// <summary>正在运行的镜像 digest（更新器记录的；还没更新过时为空）。</summary>
+    [JsonPropertyName("current")]
+    public string? Current { get; set; }
+
+    [JsonPropertyName("available")]
+    public UpdateAvailable? Available { get; set; }
+
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    [JsonPropertyName("at")]
+    public long At { get; set; }
+}
+
+/// <summary>Probe 的 <c>fleet.heartbeat</c> 附加字段：更新器的状态。</summary>
+public sealed class ProbeHeartbeatExtra
+{
+    [JsonPropertyName("update")]
+    public UpdateStatus? Update { get; set; }
+}
+
 /// <summary>Probe 的 <c>fleet.hello</c> 附加字段：系统、架构和构建信息（只用于展示和更新）。</summary>
 public sealed class ProbeHelloMeta
 {
@@ -326,6 +388,9 @@ public sealed class AgentHeartbeatExtra
 
     [JsonPropertyName("queue_bytes")]
     public long QueueBytes { get; set; }
+
+    [JsonPropertyName("update")]
+    public UpdateStatus? Update { get; set; }
 }
 
 /// <summary>Agent 下发给 Probe 的一条线路任务（期望状态类型 <c>line_task_set</c> 里的一项）。</summary>
@@ -465,6 +530,9 @@ public static class FragmentKeys
 [JsonSerializable(typeof(TestStatusParams))]
 [JsonSerializable(typeof(AgentEventParams))]
 [JsonSerializable(typeof(ProbeAgentList))]
+[JsonSerializable(typeof(UpdateOfferParams))]
+[JsonSerializable(typeof(UpdateStatus))]
+[JsonSerializable(typeof(ProbeHeartbeatExtra))]
 [JsonSerializable(typeof(ProbeHelloMeta))]
 [JsonSerializable(typeof(AgentEnrollMeta))]
 [JsonSerializable(typeof(PlatformInfo))]