feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

backend/tests/MoShiro.TestSupport/AgentSimulator.cs

@@ -80,12 +80,14 @@ public sealed class AgentSimulator : IAsyncDisposable
         string pubkey = Convert.ToBase64String(identity.PublicKeySpki);
         byte[] tokenHash = SHA256.HashData(Encoding.UTF8.GetBytes(joinToken));
         string proof = Convert.ToBase64String(identity.Sign(SignaturePurpose.Enroll, Convert.ToHexStringLower(tokenHash), pubkey));
+        using NodeIdentity tls = NodeIdentity.Generate();
         var body = new JsonObject
         {
             ["join_token"] = joinToken,
             ["name"] = name,
             ["pubkey"] = pubkey,
-            ["tls_spki"] = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)),
+            ["tls_spki"] = Convert.ToBase64String(NodeIdentity.Fingerprint(tls.PublicKeySpki)),
+            ["tls_pubkey"] = Convert.ToBase64String(tls.PublicKeySpki),
             ["proof"] = proof,
             ["node_version"] = "0.0.1-sim",
             ["meta"] = new JsonObject