feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

web/admin/src/pages/Probes.tsx

@@ -30,7 +30,7 @@ function IdentityDialog({ identity, title, onClose }: { identity: ProbeIdentityD
           </button>
           <CopyButton text={json} label="复制内容" />
         </div>
-        <Field label="在家宽机器上" hint="保存为 /etc/monitor/probe.json，然后启动 Probe；它会根据 bootstrap 列表连接 Agent，之后的 Agent 列表由面板同步。">
+        <Field label="在家宽机器上" hint="保存为 /etc/monitor/probe.json，然后启动 Probe；它会连接 probe.json 里的面板地址，Agent 列表和更新都由面板下发。">
           <pre className="code">{`monitor-probe --config /etc/monitor/probe.json`}</pre>
         </Field>
         <details>
@@ -126,7 +126,14 @@ export function Probes() {
             <div className="row wrap">
               <span style={{ fontSize: 18, fontWeight: 700 }}>{p.name}</span>
               <NodeTag info={infos.get(p.id)} />
-              {p.revoked ? <Chip tone="bad">已吊销</Chip> : <Chip tone={p.connections.length > 0 ? 'ok' : ''}>{p.connections.length > 0 ? `连着 ${p.connections.length} 个 Agent` : '没有连接'}</Chip>}
+              {p.revoked ? (
+                <Chip tone="bad">已吊销</Chip>
+              ) : (
+                <>
+                  <Chip tone={p.online ? 'ok' : ''}>{p.online ? '已连面板' : '未连面板'}</Chip>
+                  <Chip tone={p.connections.length > 0 ? 'ok' : ''}>{p.connections.length > 0 ? `连着 ${p.connections.length} 个 Agent` : '没有连接'}</Chip>
+                </>
+              )}
               <span className="mono faint">{p.id}</span>
               <span className="right row wrap">
                 <button type="button" className="btn small" onClick={() => setRenaming(p)}>