feat!: probes link to the panel; signed release updates for container nodes [CI]

Probes connect to the panel directly and get the agent list as desired state.
CI signs the image digest of agent and probe releases, the panel forwards the
manifest, and a host updater verifies it with a local public key, pulls by
digest and rolls back when the new version is unhealthy.

backend/tests/Monitor.Backend.Tests/EnrollmentAndTaskSetTests.cs

@@ -338,7 +338,7 @@ public sealed class EnrollmentAndTaskSetTests
         JsonNode identity = JsonNode.Parse(await created.Content.ReadAsStringAsync())!;
         string id = identity["probe_id"]!.GetValue<string>();
         using var key1 = Fleet.Identity.NodeIdentity.FromPkcs8(Convert.FromBase64String(identity["private_key"]!.GetValue<string>()));
-        Assert.Contains(identity["bootstrap"]!.AsArray(), b => b!["agent_id"]!.GetValue<string>() == agent.NodeId.Value);
+        Assert.True(Uri.TryCreate(identity["server"]!.GetValue<string>(), UriKind.Absolute, out _)); // Probe 直接连面板：probe.json 里是面板的地址
         await agent.WaitForTaskSetAsync(s => s.Peers.Any(p => p.ProbeId.Value == id && p.PublicKey == Convert.ToBase64String(key1.PublicKeySpki)));
 
         // The panel lists it; two probes can coexist and a duplicate name is refused
@@ -374,34 +374,6 @@ public sealed class EnrollmentAndTaskSetTests
         Assert.Equal(HttpStatusCode.NotFound, gone.StatusCode);
     }
 
-    [Fact]
-    public async Task ProbeAgentList_IsServedToAgents_AndPushedWhenTheSetOfAgentsChanges()
-    {
-        await using AgentSimulator first = await _backend.ConnectAgentAsync();
-        ProbeAgentsResult list = await first.RequestProbeAgentsAsync();
-        Assert.Contains(list.Agents, a => a.AgentId == first.NodeId && a.Host == "203.0.113.10" && a.TcpPort == 7443);
-        Assert.All(list.Agents, a => Assert.Equal(32, Convert.FromBase64String(a.Spki).Length));
-
-        await using AgentSimulator second = await _backend.ConnectAgentAsync();
-        ProbeAgentsResult pushed = await WaitForAsync(first, l => l.Agents.Any(a => a.AgentId == second.NodeId));
-        Assert.True(pushed.Version > list.Version);
-
-        using HttpResponseMessage disable = await _backend.Admin.PostAsync($"/api/admin/agents/{second.NodeId.Value}/disable", null);
-        Assert.Equal(HttpStatusCode.OK, disable.StatusCode);
-        await WaitForAsync(first, l => l.Agents.All(a => a.AgentId != second.NodeId));
-    }
-
-    private static async Task<ProbeAgentsResult> WaitForAsync(AgentSimulator agent, Func<ProbeAgentsResult, bool> predicate)
-    {
-        ProbeAgentsResult? found = null;
-        await BackendFixture.EventuallyAsync(() =>
-        {
-            found = agent.ProbeAgentLists.ToArray().LastOrDefault(predicate);
-            return Task.FromResult(found is not null);
-        });
-        return found!;
-    }
-
     private Task<HttpResponseMessage> PostEnrollAsync(JsonNode body) =>
         _backend.Anonymous.PostAsync("/api/agent/v1/enroll", BackendFixture.Json(body));
 }