feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -145,7 +145,7 @@ public sealed partial class ReleaseService : IDisposable
 
     private IEnumerable<NodeId> OnlineOf(string component) => _gateway.OnlineNodes.Where(n => ComponentOf(n) == component);
 
-    private static string? ComponentOf(NodeId node) =>
+    internal static string? ComponentOf(NodeId node) =>
         node.Value.StartsWith(AgentIds.Prefix, StringComparison.Ordinal) ? NodeKinds.Agent
         : node.Value.StartsWith(ProbeId.Prefix, StringComparison.Ordinal) ? NodeKinds.Probe
         : null;