ci: all-platform node binaries in the signed release manifest; signed SHA256SUMS for the archives; web build once before the parallel backend builds; release 0.3.3 [CI SKIP]

ci/release-node-images.sh

@@ -67,8 +67,6 @@ build_arch_image() {
     "$gitea_base/api/packages/justme/generic/moshiro-node/$version/$filename" -o "$archive"
   mkdir -p "$context/app" "$context/config"
   tar -xzf "$archive" -C "$work" "moshiro-$component" fleet-enroll
-  # 镜像里装的就是这个文件：它的哈希写进签名的发布清单（binaries），节点握手时上报正在运行的二进制的哈希，面板据此认「官方二进制」
-  sha256sum "$work/moshiro-$component" | cut -d' ' -f1 >> "$work/$component.hashes"
   install -m 0755 "$work/fleet-enroll" "$context/app/fleet-enroll"
   install -m 0755 "$work/moshiro-$component" "$context/app/moshiro-$component"
   : > "$context/config/.keep"
@@ -112,7 +110,6 @@ publish_index() {
 }
 
 for component in agent probe; do
-  rm -f "$work/$component.hashes"
   build_arch_image "$component" amd64 musl-amd64
   build_arch_image "$component" arm64 musl-arm64
   publish_index "$component"
@@ -120,6 +117,8 @@ for component in agent probe; do
   # 没有配置签名密钥（例如 fork）就只发镜像、不发清单。
   if [[ -n "${RELEASE_SIGNING_KEY:-}" ]]; then
     digest="$(cat "$work/$component.digest")"
-    RELEASE_BINARIES="$(paste -sd, "$work/$component.hashes")"       bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" release "$work/$component-release"
+    # 清单里的 binaries：所有平台、所有架构的发布压缩包里的可执行文件（不只是镜像里的 musl 那两个），节点握手时上报的哈希对得上其中任何一个
+    binaries="$(NETRC="$netrc" GITEA_BASE="$gitea_base" bash "$root/ci/release-binary-hashes.sh" "$component" "$version")"
+    RELEASE_BINARIES="$binaries" bash "$root/ci/publish-release-offer.sh" "$component" "$image_root/moshiro-$component" "$digest" "$tag" release "$work/$component-release"
   fi
 done