refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI]

The hash a node reports about itself cannot be trusted (a swapped binary can
copy the old hash), so the runtime binding only caught files that were replaced
by something that did not lie. Provenance stays where it can be verified: the
signed release manifest (digest) and the signed SHA256SUMS.

- Remove BinaryBindingService, the node_bindings table (schema v15 drops it),
  BinaryPolicy, the handshake hash/manifest fields and the admin binary column.
- Drop the per-platform "binaries" list from the release manifest, the hash
  scripts and the updater's installed.manifest copy.
- ReleaseService.PublishAsync now verifies the release signature, so the admin
  POST /releases route is no longer an unsigned path; tests sign with a test key.
- Docs: section 16 explains why the runtime check is gone.

backend/src/MoShiro.Backend.Storage.Sqlite/Schema.cs

@@ -5,7 +5,7 @@ namespace MoShiro.Backend.Storage.Sqlite;
 /// <summary>表结构。版本记录在 <c>PRAGMA user_version</c>；以后的迁移是按版本号追加的内置 SQL。</summary>
 internal static class Schema
 {
-    public const int CurrentVersion = 14;
+    public const int CurrentVersion = 15;
 
     public static void Migrate(SqliteConnection connection)
     {
@@ -241,6 +241,15 @@ internal static class Schema
             connection.Exec("PRAGMA user_version = 14");
             transaction.Commit();
         }
+
+        if (version < 15)
+        {
+            // 运行时二进制绑定整体移除（节点自报的哈希不可信，来源证明在安装时）：旧版本留下的表不再使用
+            using SqliteTransaction transaction = connection.BeginTransaction();
+            connection.Exec("DROP TABLE IF EXISTS node_bindings");
+            connection.Exec("PRAGMA user_version = 15");
+            transaction.Commit();
+        }
     }
 
     /// <summary>