feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

backend/src/MoShiro.Backend.Api/Admin/AgentEndpoints.cs

@@ -137,10 +137,10 @@ public static class AgentEndpoints
         // 信任根建立之后，命令里带上创世指纹和属主；属主默认是操作员集合里的全部 passkey，也可以只选其中几把
         OperatorSet? set = await trust.CurrentAsync(http.RequestAborted);
         string? genesis = set is null ? null : (await trust.StateAsync(AuthEndpoints.PasskeyContextOf(http, options), http.RequestAborted)).Genesis;
-        string[] controllers = set is null ? [] : [.. request.Controllers ?? [.. set.Keys.Select(k => k.CredentialId)]];
-        if (set is not null && controllers.Any(c => set.Keys.All(k => k.CredentialId != c)))
+        Result<string[]> owner = OwnerPolicy.Resolve(options.RequireOwner, set, request.Controllers);
+        if (!owner.TryGet(out string[]? controllers, out FleetError? ownerError))
         {
-            return Problems.From(http, ValidationError.Single("controllers", "must be passkeys of the operator set"));
+            return Problems.From(http, ownerError);
         }
 
         var plan = new InstallPlan(genesis, controllers, InstallScripts.Sha256(InstallScripts.Sh), InstallScripts.Sha256(InstallScripts.Ps1));