feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]

backend/openapi/v1.json

@@ -4847,6 +4847,72 @@
         }
       }
     },
+    "/install/manifest": {
+      "get": {
+        "tags": [
+          "ops"
+        ],
+        "summary": "The signed release manifest of the component an install code is for (exact signed bytes)",
+        "operationId": "install_manifest",
+        "parameters": [
+          {
+            "name": "code",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
+    "/install/manifest.sig": {
+      "get": {
+        "tags": [
+          "ops"
+        ],
+        "summary": "Base64 DER ECDSA P-256 signature of the manifest",
+        "operationId": "install_manifest_signature",
+        "parameters": [
+          {
+            "name": "code",
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK"
+          },
+          "404": {
+            "description": "Not Found",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/install.ps1": {
       "get": {
         "tags": [