feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

backend/shared/Monitor.Protocol/Rpc/MonitorRpc.cs

@@ -13,8 +13,8 @@ public static class MonitorMethods
     public const string TestStatus = "monitor.test.status";
     public const string Event = "monitor.event";
     public const string Host = "monitor.host";
-    public const string ProbeAgents = "monitor.probe.agents";
-    public const string ProbeAgentsChanged = "monitor.probe.agents_changed";
+    public const string UpdateOffer = "monitor.update.offer";
+    public const string UpdateApply = "monitor.update.apply";
 
     // Probe ↔ Agent（点对点会话）
     public const string Clock = "monitor.clock";
@@ -147,19 +147,11 @@ public sealed class AgentEndpoint
     public string Spki { get; set; } = "";
 }
 
-public sealed class ProbeAgentsParams
+/// <summary>期望状态文档（Fleet state type = <c>probe_agents</c>）：Backend 直接下发给每个 Probe 的 Agent 列表。</summary>
+public sealed class ProbeAgentList
 {
-    /// <summary>Probe 目前持有的列表版本（用于调试；服务端总是返回当前列表）。</summary>
-    [JsonPropertyName("have_version")]
-    public long HaveVersion { get; set; }
+    public const string StateType = "probe_agents";
 
-    /// <summary>Probe 的系统和架构（只用于展示；Agent 记在会话上，随连接状态报给 Backend）。</summary>
-    [JsonPropertyName("platform")]
-    public PlatformInfo? Platform { get; set; }
-}
-
-public sealed class ProbeAgentsResult
-{
     [JsonPropertyName("version")]
     public long Version { get; set; }
 
@@ -227,6 +219,73 @@ public sealed class PlatformInfo
     public string? BuiltAt { get; set; }
 }
 
+/// <summary>
+/// 面板给节点的更新清单（<c>monitor.update.offer</c>）：<c>manifest</c> 是发布清单的原始文本，<c>signature</c> 是 base64 的签名。
+/// 节点只是把它们原样放进数据目录；验签、拉取、重启都由宿主机上的更新器完成（节点进程不执行任何命令，也不信任清单的内容）。
+/// </summary>
+public sealed class UpdateOfferParams
+{
+    [JsonPropertyName("manifest")]
+    public string Manifest { get; set; } = "";
+
+    [JsonPropertyName("signature")]
+    public string Signature { get; set; } = "";
+}
+
+/// <summary>宿主机更新器已经验证过的可用更新。</summary>
+public sealed class UpdateAvailable
+{
+    [JsonPropertyName("version")]
+    public string? Version { get; set; }
+
+    [JsonPropertyName("tag")]
+    public string? Tag { get; set; }
+
+    [JsonPropertyName("digest")]
+    public string? Digest { get; set; }
+
+    [JsonPropertyName("seq")]
+    public long Seq { get; set; }
+}
+
+/// <summary>
+/// 宿主机更新器的状态（它写在 <c>update-status/status.json</c>，节点读出来随心跳上报）：
+/// <c>up_to_date</c>、<c>available</c>、<c>applying</c>、<c>failed</c>、<c>rolled_back</c>、<c>invalid</c>（清单验签或校验没过）。
+/// 没有安装更新器的节点没有这个字段。
+/// </summary>
+public sealed class UpdateStatus
+{
+    [JsonPropertyName("state")]
+    public string State { get; set; } = "";
+
+    /// <summary>正在运行的镜像 digest（更新器记录的；还没更新过时为空）。</summary>
+    [JsonPropertyName("current")]
+    public string? Current { get; set; }
+
+    [JsonPropertyName("available")]
+    public UpdateAvailable? Available { get; set; }
+
+    [JsonPropertyName("error")]
+    public string? Error { get; set; }
+
+    [JsonPropertyName("at")]
+    public long At { get; set; }
+}
+
+/// <summary>Probe 的 <c>fleet.heartbeat</c> 附加字段：更新器的状态。</summary>
+public sealed class ProbeHeartbeatExtra
+{
+    [JsonPropertyName("update")]
+    public UpdateStatus? Update { get; set; }
+}
+
+/// <summary>Probe 的 <c>fleet.hello</c> 附加字段：系统、架构和构建信息（只用于展示和更新）。</summary>
+public sealed class ProbeHelloMeta
+{
+    [JsonPropertyName("platform")]
+    public PlatformInfo? Platform { get; set; }
+}
+
 /// <summary><c>fleet.hello</c> 的附加字段。</summary>
 public sealed class AgentHelloMeta
 {
@@ -302,9 +361,6 @@ public sealed class ConnectedProbe
 
     [JsonPropertyName("since_utc_ms")]
     public long SinceUtcMs { get; set; }
-
-    [JsonPropertyName("platform")]
-    public PlatformInfo? Platform { get; set; }
 }
 
 /// <summary><c>fleet.heartbeat</c> 的附加字段：只有进程内的计数，没有主机信息。</summary>
@@ -332,6 +388,9 @@ public sealed class AgentHeartbeatExtra
 
     [JsonPropertyName("queue_bytes")]
     public long QueueBytes { get; set; }
+
+    [JsonPropertyName("update")]
+    public UpdateStatus? Update { get; set; }
 }
 
 /// <summary>Agent 下发给 Probe 的一条线路任务（期望状态类型 <c>line_task_set</c> 里的一项）。</summary>
@@ -470,8 +529,11 @@ public static class FragmentKeys
 [JsonSerializable(typeof(HostSnapshot))]
 [JsonSerializable(typeof(TestStatusParams))]
 [JsonSerializable(typeof(AgentEventParams))]
-[JsonSerializable(typeof(ProbeAgentsParams))]
-[JsonSerializable(typeof(ProbeAgentsResult))]
+[JsonSerializable(typeof(ProbeAgentList))]
+[JsonSerializable(typeof(UpdateOfferParams))]
+[JsonSerializable(typeof(UpdateStatus))]
+[JsonSerializable(typeof(ProbeHeartbeatExtra))]
+[JsonSerializable(typeof(ProbeHelloMeta))]
 [JsonSerializable(typeof(AgentEnrollMeta))]
 [JsonSerializable(typeof(PlatformInfo))]
 [JsonSerializable(typeof(AgentHelloMeta))]

backend/shared/Monitor.Protocol/Tasks/TaskSet.cs

@@ -56,9 +56,6 @@ public sealed class TaskSet
     /// <summary>允许连接到这个 Agent 的 Probe 公钥。</summary>
     [JsonPropertyName("peers")]
     public List<PeerSpec> Peers { get; set; } = [];
-
-    [JsonPropertyName("probe_agents_version")]
-    public long ProbeAgentsVersion { get; set; }
 }
 
 public static class TaskSchedule