feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

backend/openapi/v1.json

@@ -4382,6 +4382,56 @@
         "x-moshiro-capability": "update.confirm"
       }
     },
+    "/api/admin/nodes/{id}/binary": {
+      "delete": {
+        "tags": [
+          "admin-build"
+        ],
+        "summary": "Accept the node's current binary: clear its binding so the next handshake binds it again",
+        "operationId": "nodes_binary_clear",
+        "parameters": [
+          {
+            "name": "id",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content",
+            "content": {
+              "application/json": {
+                "schema": { }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          }
+        },
+        "x-moshiro-capability": "fleet.write"
+      }
+    },
     "/api/admin/backend/update": {
       "get": {
         "tags": [
@@ -6999,6 +7049,45 @@
           }
         }
       },
+      "NodeBinaryDto": {
+        "required": [
+          "sha256",
+          "signed",
+          "seq",
+          "bound_at",
+          "violation",
+          "violation_at"
+        ],
+        "type": "object",
+        "properties": {
+          "sha256": {
+            "type": "string"
+          },
+          "signed": {
+            "type": "boolean"
+          },
+          "seq": {
+            "pattern": "^-?(?:0|[1-9]\\d*)$",
+            "type": [
+              "integer",
+              "string"
+            ],
+            "format": "int64"
+          },
+          "bound_at": {
+            "format": "date-time"
+          },
+          "violation": {
+            "type": [
+              "null",
+              "string"
+            ]
+          },
+          "violation_at": {
+            "format": "date-time"
+          }
+        }
+      },
       "NodeBuildDto": {
         "required": [
           "id",
@@ -7070,6 +7159,16 @@
                 "$ref": "#/components/schemas/NodeUpdateDto"
               }
             ]
+          },
+          "binary": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/NodeBinaryDto"
+              }
+            ]
           }
         }
       },