feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/fleet/src/Fleet.Identity/NodeIdentity.cs

@@ -41,6 +41,16 @@ public sealed class NodeIdentity : IDisposable
 
     public byte[] ExportPkcs8() => _key.ExportPkcs8PrivateKey();
 
+    /// <summary>与对端公钥（SPKI）做静态 ECDH，返回原始共享秘密。只用于派生对称密钥（敲门），必须再经 KDF，不能直接当密钥用。</summary>
+    public byte[] AgreeWith(ReadOnlySpan<byte> peerSpki)
+    {
+        using ECDiffieHellman own = ECDiffieHellman.Create();
+        own.ImportPkcs8PrivateKey(_key.ExportPkcs8PrivateKey(), out _);
+        using ECDiffieHellman peer = ECDiffieHellman.Create();
+        peer.ImportSubjectPublicKeyInfo(peerSpki, out _);
+        return own.DeriveRawSecretAgreement(peer.PublicKey);
+    }
+
     public byte[] Sign(string purpose, params string[] fields) =>
         _key.SignData(Encoding.UTF8.GetBytes(SignatureString.Build(purpose, fields)), HashAlgorithmName.SHA256,
             DSASignatureFormat.IeeeP1363FixedFieldConcatenation);