feat: install nodes and the backend from a static compose file; remove dead code [CI]

Agent, Probe and Backend now start from one static compose.yaml plus a local
.env: the panel (or the release assets, for the very first Backend) provides
the file, the panel's command writes the public values into .env, checks the
file's SHA-256 and runs compose up. Updating is compose pull && compose up -d.
The image is chosen by the CI channel (:latest, or MOSHIRO_VERSION in .env),
not by the panel; the previous one-line script stays as a fallback.

- packaging/compose/{agent,probe,backend}/compose.yaml are the single source,
  embedded in the Backend and served at /install/compose/{file}; the root
  compose.yaml moved there. Releases also carry them and list them in the
  signed SHA256SUMS.
- The container entrypoint defaults the node name to the host name.
- Join token creation returns a compose block (.env, url, hash, per-platform
  commands); the admin dialog leads with it.
- Remove code with no references (HotLayer members, LiveHub.SubscriberCount,
  QueryService.ParseParams, ReleaseService.Forget, a few constants) and reduce
  the install-code lookup to the role it is for.

docs/security/enrollment.md

@@ -16,10 +16,11 @@
 
 ```text
 管理员 ── 创建加入令牌 {标签, max_uses, 过期时间, auto_approve, controllers} ──> 面板（Fleet.Server.Enrollment）
-       <── 一行安装命令（Agent 和 Probe 共用）：先下载静态安装脚本、核对它的 SHA-256，一致才执行；
-           面板地址、角色、一次性码、创世指纹和属主都走环境变量，命令里只有公开的值（见 access.md 第 10 节）
+       <── 一段 compose 安装命令（默认）：建目录、把面板地址、一次性码、创世指纹和属主写进本地 .env，下载面板提供的静态
+           compose.yaml 并核对 SHA-256，再 `compose up -d`；命令里只有公开的值（见 access.md 第 10 节）。
+           备用：一行安装脚本（先核对脚本哈希再执行），参数走环境变量
 
-install.sh / install.ps1（packaging/install/，嵌入 Backend，静态文件，不替换任何值）：
+两条路径做的事一样：compose 的入口脚本，或 install.sh / install.ps1（packaging/install/，嵌入 Backend，静态文件，不替换任何值）：
   ├─ 向面板取 CI 签名的发布清单，用脚本里内置的发布公钥验签，按清单里的 digest 拉镜像
   ├─ 用 Docker 或 Podman 起容器，身份和配置存在命名卷里；节点名字默认取主机名
   └─ 容器入口用代码注册：fleet-enroll --server … --join jt_… --genesis … --controllers …