refactor: remove the runtime binary binding; every release registration path verifies the CI signature [CI]

The hash a node reports about itself cannot be trusted (a swapped binary can
copy the old hash), so the runtime binding only caught files that were replaced
by something that did not lie. Provenance stays where it can be verified: the
signed release manifest (digest) and the signed SHA256SUMS.

- Remove BinaryBindingService, the node_bindings table (schema v15 drops it),
  BinaryPolicy, the handshake hash/manifest fields and the admin binary column.
- Drop the per-platform "binaries" list from the release manifest, the hash
  scripts and the updater's installed.manifest copy.
- ReleaseService.PublishAsync now verifies the release signature, so the admin
  POST /releases route is no longer an unsigned path; tests sign with a test key.
- Docs: section 16 explains why the runtime check is gone.

packaging/update/moshiro-update.sh

@@ -122,8 +122,7 @@ fetch_offer() {
     cp "$OFFER_MANIFEST" "$WORK/feed.manifest"; cp "$OFFER_SIG" "$WORK/feed.sig"
   fi
   fetch_mailbox
-  # 信箱里没有东西，而仓库里的清单没通过（验证失败，或者就是已经装的这一份）：留下仓库的那份，让后面照常报出原因，
-  # 而不是悄悄当作没有更新；「已经装的这一份」也要留下，因为要把它交给节点握手时带给 Backend
+  # 信箱里没有东西，而仓库里的清单没通过（验证失败，或者就是已经装的这一份）：留下仓库的那份，让后面照常报出原因，而不是悄悄当作没有更新
   if [ -n "$feed_error" ] && [ ! -s "$OFFER_MANIFEST" ]; then
     cp "$WORK/feed.manifest" "$OFFER_MANIFEST"; cp "$WORK/feed.sig" "$OFFER_SIG"
   fi
@@ -165,29 +164,6 @@ write_status() { # state available_json error
   fi
 }
 
-# 节点握手时要带给 Backend 的「我是从哪份 CI 签名清单安装的」：Backend 用 CI 公钥验过，才相信清单里列的官方二进制哈希。
-# 写在节点只读挂载的状态目录里（节点自己改不了），清单在前、签名在后；内容没变就不写（保护路由器的闪存）。
-write_installed() {
-  if cmp -s "$OFFER_MANIFEST" "$STATE_DIR/$COMPONENT.installed.manifest" 2>/dev/null && cmp -s "$OFFER_SIG" "$STATE_DIR/$COMPONENT.installed.sig" 2>/dev/null; then
-    return 0
-  fi
-  for pair in "installed.manifest:$OFFER_MANIFEST" "installed.sig:$OFFER_SIG"; do
-    name="${pair%%:*}"; src="${pair#*:}"
-    if [ -n "$DATA_VOLUME" ]; then
-      "$ENGINE" run --pull=never --rm -i --user 0 --network none --read-only --cap-drop ALL --cap-add DAC_OVERRIDE --security-opt no-new-privileges \
-        -v "$STATUS_VOLUME:/status" --entrypoint /bin/sh "$HELPER_IMAGE" \
-        -c 'tmp=$(mktemp /status/.installed.XXXXXX); cat > "$tmp"; chmod 644 "$tmp"; mv -f "$tmp" "/status/$1"' sh "$name" < "$src" || return 0
-    else
-      destination="$(mktemp "$STATUS_DIR/.installed.XXXXXX")"
-      cp "$src" "$destination"
-      chmod 644 "$destination"
-      mv -f "$destination" "$STATUS_DIR/$name"
-    fi
-  done
-  cp "$OFFER_MANIFEST" "$STATE_DIR/$COMPONENT.installed.manifest"
-  cp "$OFFER_SIG" "$STATE_DIR/$COMPONENT.installed.sig"
-}
-
 # 第一次部署（deploy-node.sh 已经验过签并按 digest 固定）时还没有安装记录：清单的 digest 就是正在跑的这个镜像，就记下来，不当作「有更新」
 seed_installed() {
   [ ! -r "$INSTALLED" ] || return 0
@@ -283,8 +259,6 @@ do_check() {
     case "$ERR" in
       "no offer") write_status up_to_date null "" ;;
       "stale manifest"*)
-        # 就是已经装的这一份（同一个 seq、同一个 digest）：交给节点握手时带给 Backend
-        if [ "$M_SEQ" = "$(installed_seq)" ] && [ "$M_DIGEST" = "$(current_digest)" ]; then write_installed; fi
         write_status up_to_date null "" ;;
       *) write_status invalid null "$ERR"; echo "offer rejected: $ERR" >&2 ;;
     esac
@@ -293,7 +267,6 @@ do_check() {
   adopt_next_key
   seed_installed
   if [ "$M_DIGEST" = "$(current_digest)" ]; then
-    write_installed
     write_status up_to_date null ""
     return 0
   fi
@@ -339,7 +312,6 @@ do_apply() {
   fi
   if [ "$healthy" = true ] && service_ctl is-active --quiet "$UNIT" && [ "$before" = "$after" ]; then
     printf '%s\n%s\n' "$M_SEQ" "$M_DIGEST" > "$INSTALLED"
-    write_installed
     write_status up_to_date null ""
     echo "updated to $M_TAG"
     return 0