feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

ci/binary-hash.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# 镜像里某个可执行文件的 SHA-256：ci/binary-hash.sh <镜像> <镜像里的路径>
+# 节点握手时上报的就是它正在运行的那个文件的哈希，CI 把这个哈希写进签名的清单（binaries），Backend 据此认「官方二进制」。
+# 先试在镜像里运行 sha256sum（同架构），不行再挂载镜像文件系统直接读。
+set -euo pipefail
+image="${1:?usage: binary-hash.sh <image> <path>}"; path="${2:?path in the image}"
+container="$(buildah from "$image")"
+trap 'buildah rm "$container" >/dev/null 2>&1 || true' EXIT
+if out="$(buildah run "$container" -- sha256sum "$path" 2>/dev/null)" && [[ "$out" =~ ^([0-9a-f]{64})[[:space:]] ]]; then
+  echo "${BASH_REMATCH[1]}"
+  exit 0
+fi
+buildah unshare bash -c '
+  set -euo pipefail
+  mount="$(buildah mount "$1")"
+  sha256sum "$mount$2" | cut -d" " -f1
+  buildah umount "$1" >/dev/null
+' _ "$container" "$path"