fix: the panel polls the registry for its own and the nodes' releases [CI]

Registering a manifest with the panel is best effort in CI (an unreachable
panel only warns, the pipeline stays green). The Backend update notice then
never appeared, because the host updater only reads the mailbox the panel
writes. A background poller now fetches the signed manifests of the agent, the
probe and the backend itself from the registry every five minutes, verifies the
release signature and registers them, writing the backend one into the host
updater's mailbox.

backend/src/MoShiro.Backend.Application/ApplicationServiceCollectionExtensions.cs

@@ -71,6 +71,7 @@ public static class ApplicationServiceCollectionExtensions
         services.AddHostedService(provider => provider.GetRequiredService<TestFinalizer>());
         services.AddHostedService<HotLayerBackfill>();
         services.AddHostedService<RetentionService>();
+        services.AddHostedService<ReleasePoller>();
         return services;
     }
 }

backend/src/MoShiro.Backend.Application/Updates/ReleasePoller.cs

@@ -0,0 +1,58 @@
+using Microsoft.Extensions.Hosting;
+using Microsoft.Extensions.Logging;
+using MoShiro.Protocol;
+
+namespace MoShiro.Backend.Application;
+
+/// <summary>
+/// 定时去镜像仓库取各组件（Agent、Probe、Backend 自己）最新的签名清单：CI 把清单登记给面板那一步是尽力而为的（网络不通只警告），
+/// 面板自己也去仓库取，Backend 的更新通知和节点的更新建议就不依赖那一步。取回来的清单要用发布公钥验过签才登记。
+/// </summary>
+public sealed partial class ReleasePoller : BackgroundService
+{
+    private static readonly TimeSpan s_startupDelay = TimeSpan.FromSeconds(20);
+    private static readonly TimeSpan s_interval = TimeSpan.FromMinutes(5);
+    private static readonly string[] s_components = [NodeKinds.Agent, NodeKinds.Probe, ReleaseService.BackendComponent];
+
+    private readonly ReleaseService _releases;
+    private readonly TimeProvider _time;
+    private readonly ILogger<ReleasePoller> _log;
+
+    public ReleasePoller(ReleaseService releases, TimeProvider time, ILogger<ReleasePoller> log)
+    {
+        _releases = releases;
+        _time = time;
+        _log = log;
+    }
+
+    protected override async Task ExecuteAsync(CancellationToken stoppingToken)
+    {
+        try
+        {
+            await Task.Delay(s_startupDelay, _time, stoppingToken);
+            using var timer = new PeriodicTimer(s_interval, _time);
+            do
+            {
+                foreach (string component in s_components)
+                {
+                    try
+                    {
+                        await _releases.GetOrFetchAsync(component, stoppingToken);
+                    }
+                    catch (Exception ex) when (ex is not OperationCanceledException)
+                    {
+                        LogFailed(ex, component);
+                    }
+                }
+            }
+            while (await timer.WaitForNextTickAsync(stoppingToken));
+        }
+        catch (OperationCanceledException)
+        {
+            // 后端正在停止
+        }
+    }
+
+    [LoggerMessage(Level = LogLevel.Warning, Message = "could not check the registry for the latest {Component} release")]
+    private partial void LogFailed(Exception exception, string component);
+}

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -100,16 +100,17 @@ public sealed partial class ReleaseService : IDisposable
     /// </summary>
     public async ValueTask<ReleaseOffer?> GetOrFetchAsync(string component, CancellationToken ct)
     {
-        ReleaseOffer? stored = await GetAsync(component, ct);
+        string channel = BackendUpdates.ChannelOf(_options);
+        ReleaseOffer? stored = component == BackendComponent ? await GetBackendAsync(channel, ct) : await GetAsync(component, ct);
         long now = Environment.TickCount64;
-        long wait = stored is null ? 30_000 : 600_000; // 没有就 30 秒试一次，已经有了就隔 10 分钟看一眼有没有更新的
+        long wait = stored is null ? 30_000 : 240_000; // 没有就 30 秒试一次，已经有了就隔 4 分钟看一眼有没有更新的（后台每 5 分钟问一次）
         if (_feedChecked.TryGetValue(component, out long last) && now - last < wait)
         {
             return stored;
         }
 
         _feedChecked[component] = now;
-        if (await _feed.FetchAsync(component, BackendUpdates.ChannelOf(_options), ct) is { } fetched && await _keys.VerifyAsync(fetched.Manifest, fetched.Signature, ct))
+        if (await _feed.FetchAsync(component, channel, ct) is { } fetched && await _keys.VerifyAsync(fetched.Manifest, fetched.Signature, ct))
         {
             Result<ReleaseOffer> published = await PublishAsync(fetched.Manifest, fetched.Signature, ct);
             if (published.IsSuccess)