feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

backend/fleet/src/Fleet.Server.Enrollment/FleetEnrollmentService.cs

@@ -61,17 +61,6 @@ public sealed partial class FleetEnrollmentService
             return Result<EnrollResponse>.Fail(FleetErrors.ProofInvalid, "proof of possession does not verify");
         }
 
-        // 带操作员委托的码：节点必须附上用码的私钥签的绑定，委托、绑定和这次注册的密钥、名字、角色都对得上才收
-        MemberProofDto? memberProof = null;
-        if (token.Grant is not null)
-        {
-            Result<MemberProofDto> verified = await VerifyBindingAsync(token, request, publicKey, tlsPublicKey, ct);
-            if (!verified.TryGet(out memberProof, out FleetError? bindingError))
-            {
-                return Result<EnrollResponse>.Fail(bindingError);
-            }
-        }
-
         if (!await _store.TryConsumeJoinTokenAsync(token.Id, nowMs, ct))
         {
             return Result<EnrollResponse>.Fail(FleetErrors.JoinTokenInvalid, "join token is invalid");
@@ -94,8 +83,7 @@ public sealed partial class FleetEnrollmentService
             nowMs,
             token.Kind,
             tlsPublicKey,
-            token.CreatedBy,
-            memberProof);
+            token.CreatedBy);
 
         Result<NodeRecord> created = await _store.CreateNodeAsync(node, ct);
         if (!created.TryGet(out NodeRecord? record, out FleetError? error))
@@ -116,7 +104,7 @@ public sealed partial class FleetEnrollmentService
         });
     }
 
-    /// <summary>节点注册之前取：操作员集合的链，和这个码的委托（如果有）。码要是有效的；不能用的码不给。</summary>
+    /// <summary>节点注册之前取：操作员集合的链。码要是有效的；不能用的码不给。</summary>
     public async ValueTask<Result<TrustBundle>> GetTrustAsync(string joinToken, CancellationToken ct)
     {
         JoinTokenRecord? token = await _store.FindJoinTokenAsync(TokenHash.Sha256(joinToken), ct);
@@ -131,7 +119,7 @@ public sealed partial class FleetEnrollmentService
             return Result<TrustBundle>.Fail(FleetErrors.JoinTokenExpired, "join token has expired");
         }
 
-        var bundle = new TrustBundle { Grant = token.Grant };
+        var bundle = new TrustBundle();
         foreach (IOperatorTrustSource source in _trust)
         {
             bundle.Chain.AddRange(await source.ChainAsync(ct));
@@ -140,26 +128,6 @@ public sealed partial class FleetEnrollmentService
         return Result<TrustBundle>.Ok(bundle);
     }
 
-    private async ValueTask<Result<MemberProofDto>> VerifyBindingAsync(JoinTokenRecord token, EnrollRequest request, byte[] publicKey, byte[] tlsPublicKey, CancellationToken ct)
-    {
-        IReadOnlyList<SignedStatementDto> chain = _trust.Any() ? await _trust.First().ChainAsync(ct) : [];
-        OperatorSet? current = chain.Count == 0 ? null : OperatorTrust.VerifyChain(OperatorTrust.Fingerprint(chain[0].Statement), [.. chain.Select(c => c.ToSigned())]);
-        if (current is null || string.IsNullOrEmpty(request.Binding) || string.IsNullOrEmpty(request.BindingSignature))
-        {
-            return Result<MemberProofDto>.Fail(FleetErrors.ProofInvalid, "this join code carries an operator grant: the enrollment needs a binding signed with the code key");
-        }
-
-        string role = token.Kind.Length == 0 ? "agent" : token.Kind;
-        var proof = new MemberProofDto { Grant = token.Grant!, Binding = request.Binding, BindingSignature = request.BindingSignature };
-        TrustFailure failure = OperatorTrust.VerifyMember(current, proof.ToProof(), publicKey, tlsPublicKey, role);
-        if (failure != TrustFailure.None || OperatorTrust.ParseBinding(request.Binding)?.Name != request.Name)
-        {
-            return Result<MemberProofDto>.Fail(FleetErrors.ProofInvalid, "the binding does not verify against the operator's grant (" + failure + ")");
-        }
-
-        return Result<MemberProofDto>.Ok(proof);
-    }
-
     private static bool TryDecode(string text, out byte[] data)
     {
         try