feat: every agent and probe must have an owner passkey, enforced by the panel, the installers and fleet-enroll [CI]

packaging/container/entrypoint.sh

@@ -13,6 +13,13 @@ if [ ! -f "$identity/node.json" ]; then
     echo "first start: set MOSHIRO_SERVER, MOSHIRO_JOIN and MOSHIRO_NAME (the panel shows the complete command)" >&2
     exit 1
   fi
+  # 每个节点都必须有属主（passkey）：信任根指纹和属主缺一个就不注册
+  if [ -z "${MOSHIRO_GENESIS:-}" ] || [ -z "${MOSHIRO_CONTROLLERS:-}" ]; then
+    if [ "${MOSHIRO_ALLOW_NO_OWNER:-}" != 1 ]; then
+      echo "this node has no owner: set MOSHIRO_GENESIS and MOSHIRO_CONTROLLERS (the panel's command has them; set up the trust root first)" >&2
+      exit 1
+    fi
+  fi
   if [ -n "${MOSHIRO_GENESIS:-}" ]; then
     # 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
     /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \