feat: the one-line installer verifies the CI-signed release manifest and pulls the image by digest [CI]

backend/src/MoShiro.Backend.Api/InstallScripts.cs

@@ -9,12 +9,22 @@ namespace MoShiro.Backend.Api;
 /// </summary>
 public static class InstallScripts
 {
+    /// <summary>CI 的发布公钥（<c>packaging/update/release-key.pub.pem</c>）：脚本用它验发布清单的签名。</summary>
+    public static string ReleaseKey()
+    {
+        using Stream stream = typeof(InstallScripts).Assembly.GetManifestResourceStream("release-key.pub.pem")
+            ?? throw new InvalidOperationException("the embedded release key is missing");
+        using var reader = new StreamReader(stream);
+        return reader.ReadToEnd();
+    }
+
     public static string Render(string resource, InstallTarget target)
     {
         using Stream stream = typeof(InstallScripts).Assembly.GetManifestResourceStream(resource)
             ?? throw new InvalidOperationException($"the embedded resource {resource} is missing");
         using var reader = new StreamReader(stream);
         return reader.ReadToEnd()
+            .Replace("@@RELEASE_KEY@@", ReleaseKey().Trim(), StringComparison.Ordinal)
             .Replace("@@ROLE@@", target.Role, StringComparison.Ordinal)
             .Replace("@@SERVER@@", target.Server, StringComparison.Ordinal)
             .Replace("@@CODE@@", target.Code, StringComparison.Ordinal)