feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

packaging/container/entrypoint.sh

@@ -13,7 +13,13 @@ if [ ! -f "$identity/node.json" ]; then
     echo "first start: set MOSHIRO_SERVER, MOSHIRO_JOIN and MOSHIRO_NAME (the panel shows the complete command)" >&2
     exit 1
   fi
-  /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
+  if [ -n "${MOSHIRO_GENESIS:-}" ]; then
+    # 命令里带着信任根指纹和属主（公开值）：先验证面板的操作员集合，并把它们固定在本地
+    /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity" \
+      --genesis "$MOSHIRO_GENESIS" --controllers "${MOSHIRO_CONTROLLERS:-}"
+  else
+    /usr/local/bin/fleet-enroll --server "$MOSHIRO_SERVER" --join "$MOSHIRO_JOIN" --name "$MOSHIRO_NAME" --identity-dir "$identity"
+  fi
 fi
 
 if [ ! -f "$config" ]; then