feat: pinned agents and probes only accept peers carrying the operator's proof; the panel ships the signed operator chain with the rosters [CI SKIP]

backend/tests/MoShiro.Backend.Tests/AgentHarness.cs

@@ -41,12 +41,14 @@ public sealed class AgentHarness : IAsyncDisposable
 
     public byte[] TlsPublicKey => _identity.Certificate.PublicKey.ExportSubjectPublicKeyInfo();
 
-    public static async Task<AgentHarness> StartAsync(BackendFixture backend, Action<AgentConfig>? configure = null, string? name = null)
+    /// <param name="signed">操作员签过委托的加入码（认证串、种子、创世指纹）：节点按固定了创世的方式注册，名册里的 Probe 必须带操作员批准的证明。</param>
+    public static async Task<AgentHarness> StartAsync(BackendFixture backend, Action<AgentConfig>? configure = null, string? name = null, (string Auth, string Seed, string Genesis)? signed = null)
     {
         string directory = Path.Combine(Path.GetTempPath(), "moshiro-agent-" + Guid.NewGuid().ToString("N"));
-        string token = await backend.CreateJoinTokenAsync();
+        string token = signed?.Auth ?? await backend.CreateJoinTokenAsync();
         using var http = new HttpClient();
-        Result<EnrollmentResult> enrolled = await EnrollmentClient.EnrollAsync(http, backend.BaseAddress, token, name ?? backend.UniqueName("agent"), directory, AgentApp.Version, null, TimeProvider.System, CancellationToken.None);
+        Result<EnrollmentResult> enrolled = await EnrollmentClient.EnrollAsync(
+            http, backend.BaseAddress, token, name ?? backend.UniqueName("agent"), directory, AgentApp.Version, null, TimeProvider.System, CancellationToken.None, signed?.Seed, signed?.Genesis, "agent");
         Assert.True(enrolled.IsSuccess, enrolled.IsSuccess ? "" : enrolled.Error.ToString());
 
         // 测试里的 Agent 只在回环上监听：手填 public_host（手动的优先于自动识别，Agent 上报本机真实地址也不会覆盖）