feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

web/shared/api/schema.ts

@@ -963,13 +963,6 @@ export interface components {
             behavior: string;
             samplers: string[];
         };
-        BootstrapAgentDto: {
-            agent_id: string;
-            host: string;
-            /** Format: int32 */
-            tcp_port: number | string;
-            spki: string;
-        };
         BuildDto: {
             version: string;
             tag: null | string;
@@ -1445,12 +1438,13 @@ export interface components {
             /** Format: date-time */
             revoked_at: unknown;
             revoked: boolean;
+            online: boolean;
             connections: components["schemas"]["ProbeConnectionDto"][];
         };
         ProbeIdentityDto: {
             probe_id: string;
             private_key: string;
-            bootstrap: components["schemas"]["BootstrapAgentDto"][];
+            server: string;
             limits: components["schemas"]["ProbeLimitsDto"];
         };
         ProbeLimitsDto: {