feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

backend/src/Monitor.Backend.Application/Agents/AgentService.cs

@@ -123,11 +123,11 @@ public sealed partial class AgentService
     }
 
     /// <summary>Probe 需要连接的 Agent 列表（所有已激活的 Agent）。版本号在列表变化时递增。</summary>
-    public async ValueTask<ProbeAgentsResult> ProbeAgentsAsync(CancellationToken ct)
+    public async ValueTask<ProbeAgentList> ProbeAgentsAsync(CancellationToken ct)
     {
         IReadOnlyList<AgentRecord> agents = await _agents.ListAsync(ct);
         long version = long.TryParse(await _settings.GetAsync(TaskPlanner.ProbeAgentsVersionKey, ct), out long v) ? v : 0;
-        var result = new ProbeAgentsResult { Version = version };
+        var result = new ProbeAgentList { Version = version };
         foreach (AgentRecord agent in agents.Where(a => a.Status == NodeStatus.Active && a.PublicHost.Length > 0))
         {
             result.Agents.Add(new AgentEndpoint
@@ -144,12 +144,11 @@ public sealed partial class AgentService
         return result;
     }
 
-    /// <summary>Agent 集合变了：递增列表版本、重算各 Agent 的期望状态、通知 Probe。</summary>
+    /// <summary>Agent 集合变了：递增列表版本，重算各 Agent 的期望状态，并把新的 Agent 列表推给 Probe（都是期望状态，一起通知）。</summary>
     public async ValueTask AfterAgentSetChangedAsync(CancellationToken ct)
     {
         await _planner.BumpProbeAgentsVersionAsync(ct);
         _gateway.NotifyAllTaskSetsChanged();
-        await _gateway.NotifyProbeAgentsChangedAsync(await ProbeAgentsAsync(ct), ct);
     }
 
     private async ValueTask<Result<AgentView>> ChangeStatusAsync(NodeId id, NodeStatus status, CancellationToken ct)