feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

backend/src/MoShiro.Backend.Api/InstallScripts.cs

@@ -1,33 +1,32 @@
 using System.Reflection;
-using MoShiro.Backend.Application;
+using System.Security.Cryptography;
+using System.Text;
 
 namespace MoShiro.Backend.Api;
 
 /// <summary>
-/// 一行安装脚本：<c>packaging/install/</c> 下的 <c>install.sh</c> 和 <c>install.ps1</c> 作为嵌入资源打进 Backend，
-/// 这里把角色、网关、代码和镜像填进去。Agent 和 Probe 共用同一份，不分开维护。
+/// 一行安装脚本：<c>packaging/install/</c> 下的 <c>install.sh</c> 和 <c>install.ps1</c> 作为嵌入资源打进 Backend，<b>原样返回，不替换任何值</b>。
+/// 静态，所以它的 SHA-256 在一个版本内固定：CI 构建时算出来写进签名的发布清单，面板给的命令先核对哈希再执行（docs/access.md 第 15 节）。
+/// 角色、面板地址、代码都走命令里的环境变量。
 /// </summary>
 public static class InstallScripts
 {
-    /// <summary>CI 的发布公钥（<c>packaging/update/release-key.pub.pem</c>）：脚本用它验发布清单的签名。</summary>
-    public static string ReleaseKey()
-    {
-        using Stream stream = typeof(InstallScripts).Assembly.GetManifestResourceStream("release-key.pub.pem")
-            ?? throw new InvalidOperationException("the embedded release key is missing");
-        using var reader = new StreamReader(stream);
-        return reader.ReadToEnd();
-    }
+    public const string Sh = "install.sh";
+    public const string Ps1 = "install.ps1";
 
-    public static string Render(string resource, InstallTarget target)
+    /// <summary>CI 的发布公钥（<c>packaging/update/release-key.pub.pem</c>）：脚本里内置的就是这一把，测试核对两边一致。</summary>
+    public static string ReleaseKey() => Read("release-key.pub.pem").Trim();
+
+    public static string Script(string resource) => Read(resource);
+
+    /// <summary>脚本内容的 SHA-256（小写十六进制，按 UTF-8 字节）。</summary>
+    public static string Sha256(string resource) => Convert.ToHexStringLower(SHA256.HashData(Encoding.UTF8.GetBytes(Read(resource))));
+
+    private static string Read(string resource)
     {
         using Stream stream = typeof(InstallScripts).Assembly.GetManifestResourceStream(resource)
             ?? throw new InvalidOperationException($"the embedded resource {resource} is missing");
         using var reader = new StreamReader(stream);
-        return reader.ReadToEnd()
-            .Replace("@@RELEASE_KEY@@", ReleaseKey().Trim(), StringComparison.Ordinal)
-            .Replace("@@ROLE@@", target.Role, StringComparison.Ordinal)
-            .Replace("@@SERVER@@", target.Server, StringComparison.Ordinal)
-            .Replace("@@CODE@@", target.Code, StringComparison.Ordinal)
-            .Replace("@@IMAGE@@", target.Image, StringComparison.Ordinal);
+        return reader.ReadToEnd();
     }
 }