fix(ci): restore with PublishAot so node images are native, add compose files

Agent and probe images were built with a restore step that lacked
PublishAot, so the publish silently produced a trimmed launcher that looks
for a .dll. Restore now passes PublishAot and the build fails if the binary
is smaller than 2 MB. Also add agent and probe compose files and document
the [CI] marker in AGENTS.md.

packaging/container/Probe.NativeBuild.Containerfile

@@ -7,14 +7,17 @@ ARG MONITOR_COMMIT=
 ARG MONITOR_BUILT_AT=
 ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
 COPY restore/backend/ ./
-RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 --artifacts-path /artifacts
+# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
+RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
-RUN test -x /out/probe/monitor-probe
+# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
+RUN test -x /out/probe/monitor-probe \
+    && test "$(stat -c%s /out/probe/monitor-probe)" -gt 2000000
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra