feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

backend/fleet/src/Fleet.Enrollment.Client/EnrollmentClient.cs

@@ -46,6 +46,12 @@ public static class EnrollmentClient
         TrustBundle? bundle = null;
         if (genesis is not null)
         {
+            if (controllers is not { Count: > 0 })
+            {
+                // 每个节点都必须有属主：没有属主的节点没有人能授权它的敏感操作
+                return Result<EnrollmentResult>.Fail(FleetErrors.InvalidParams, "an owner is required: pass the passkey credential ids from the panel's command (--controllers)");
+            }
+
             Result<TrustBundle> trusted = await FetchTrustAsync(http, server, joinToken, genesis, controllers ?? [], ct);
             if (!trusted.TryGet(out bundle, out FleetError? trustError))
             {

backend/fleet/tools/fleet-enroll/Program.cs

@@ -33,6 +33,12 @@ if (Arg("--meta") is { } metaText)
 string? genesis = Arg("--genesis");
 string[] controllers = (Arg("--controllers") ?? "").Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
 
+if (genesis is not null && controllers.Length == 0)
+{
+    Console.Error.WriteLine("--genesis needs --controllers: every node has an owner (the passkey credential ids from the panel's command)");
+    return 2;
+}
+
 using var http = new HttpClient { Timeout = TimeSpan.FromSeconds(30) };
 Result<EnrollmentResult> result = await EnrollmentClient.EnrollAsync(
     http, new Uri(server), join, name, directory, Arg("--version") ?? "0.0.0", meta, TimeProvider.System, CancellationToken.None, genesis, controllers);