refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI]

The hash a node reports about itself cannot be trusted (a swapped binary can
copy the old hash), so the runtime binding only caught files that were replaced
by something that did not lie. Provenance stays where it can be verified: the
signed release manifest (digest) and the signed SHA256SUMS.

- Remove BinaryBindingService, the node_bindings table (schema v15 drops it),
  BinaryPolicy, the handshake hash/manifest fields and the admin binary column.
- Drop the per-platform "binaries" list from the release manifest, the hash
  scripts and the updater's installed.manifest copy.
- ReleaseService.PublishAsync now verifies the release signature, so the admin
  POST /releases route is no longer an unsigned path; tests sign with a test key.
- Docs: section 16 explains why the runtime check is gone.

backend/src/MoShiro.Backend.Application/Updates/IReleaseKey.cs

@@ -0,0 +1,7 @@
+namespace MoShiro.Backend.Application;
+
+/// <summary>CI 发布公钥（PEM）：验登记的发布清单。由 Api 层提供（它就是内嵌在程序里的那一把）。</summary>
+public interface IReleaseKey
+{
+    string Pem { get; }
+}

backend/src/MoShiro.Backend.Application/Updates/ReleaseService.cs

@@ -45,7 +45,7 @@ public sealed partial class ReleaseService : IDisposable
 
     public void Dispose() => BackendGate.Dispose();
 
-    /// <summary>登记一份新清单并推给在线的同类节点。只要格式对、<c>seq</c> 比现有的新就收下（签名由节点验证）。</summary>
+    /// <summary>登记一份新清单并推给在线的同类节点。格式对、带 CI 发布密钥的有效签名、<c>seq</c> 比现有的新才收下；所有登记入口（CI、镜像仓库、管理员）都走这里，所以没有不验签的路径。节点的更新器之后还会用本机公钥再验一次。</summary>
     public async ValueTask<Result<ReleaseOffer>> PublishAsync(string manifest, string signature, CancellationToken ct)
     {
         if (!TryParse(manifest, signature, out ReleaseOffer? offer, out string? problem))
@@ -53,6 +53,11 @@ public sealed partial class ReleaseService : IDisposable
             return ValidationError.Fail<ReleaseOffer>("manifest", problem);
         }
 
+        if (!ReleaseSignature.Verify(_key.Pem, manifest, signature))
+        {
+            return Result<ReleaseOffer>.Fail(MoShiroErrors.Forbidden, "the manifest does not carry a valid release signature");
+        }
+
         await BackendGate.WaitAsync(ct);
         try
         {