feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/shared/MoShiro.Measurement/Core/Contracts.cs

@@ -217,6 +217,9 @@ public sealed class BlockEnv
     /// <summary>拨号方：对端 TLS 证书的 SPKI 指纹；null 表示不校验证书（目标任务，目标是任意地址）。</summary>
     public byte[]? PeerSpkiSha256 { get; init; }
 
+    /// <summary>拨号方：和对端（Agent）的配对敲门密钥；每条 TCP 连接建立后先发敲门包。null 表示对端不要求敲门（目标任务的任意地址）。</summary>
+    public byte[]? KnockKey { get; init; }
+
     /// <summary>拨号方：列块出口。</summary>
     public IFragmentSink? Fragments { get; init; }
 
@@ -241,6 +244,7 @@ public sealed class BlockEnv
             TcpListen = TcpListen,
             PeerAddress = PeerAddress,
             PeerSpkiSha256 = PeerSpkiSha256,
+            KnockKey = KnockKey,
             Fragments = Fragments,
             MaxBulkMbps = MaxBulkMbps,
             MaxPacketsPerSecond = MaxPacketsPerSecond,