feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

backend/probe/src/MoShiro.Probe/ProbeApp.cs

@@ -33,11 +33,13 @@ public sealed class ProbeApp : IDisposable
         directory.Changed += () => _changed.Release();
 
         var update = new UpdateBridge(configDirectory, new ConfigStore(configDirectory).Write, log);
+        NodeBinary.Prime(); // 正在运行的二进制的哈希：先在后台算好，握手时用
         var options = new FleetLinkOptions
         {
             Server = new Uri(file.Fleet.Server),
             Identity = identity.Identity,
             ServerVerifier = trust,
+            Attestation = update.Attest,
             NodeId = identity.NodeId,
             NodeVersion = Version,
             Capabilities = [MoShiroCapabilities.Base],