feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

backend/tests/Monitor.TestSupport/ProbeSimulator.cs

@@ -61,8 +61,6 @@ public sealed class ProbeSimulator : IAsyncDisposable
 
     public ConcurrentQueue<TestId> Aborts { get; } = new();
 
-    public ConcurrentQueue<ProbeAgentsResult> AgentLists { get; } = new();
-
     public bool IsConnected => _rpc is not null && !_stop.IsCancellationRequested;
 
     public long NowUs() => (TimeProvider.System.GetTimestamp() - _origin) * 1_000_000 / TimeProvider.System.TimestampFrequency;
@@ -347,14 +345,6 @@ public sealed class ProbeSimulator : IAsyncDisposable
                     probe.Aborts.Enqueue(abort.TestId);
                     return ValueTask.CompletedTask;
                 })
-            .OnNotify(
-                MonitorMethods.ProbeAgentsChanged,
-                MonitorJsonContext.Default.ProbeAgentsResult,
-                (probe, list, _) =>
-                {
-                    probe.AgentLists.Enqueue(list);
-                    return ValueTask.CompletedTask;
-                })
             .OnNotify(
                 FleetMethods.OutboxAck,
                 FleetRpcContext.Default.OutboxAckParams,