feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/src/MoShiro.Backend.Application/Agents/AgentService.cs

@@ -157,7 +157,8 @@ public sealed partial class AgentService
         IReadOnlyList<AgentRecord> agents = await _agents.ListAsync(ct);
         long version = long.TryParse(await _settings.GetAsync(TaskPlanner.ProbeAgentsVersionKey, ct), out long v) ? v : 0;
         var result = new ProbeAgentList { Version = version };
-        foreach (AgentRecord agent in agents.Where(a => a.Status == NodeStatus.Active && a.PublicHost.Length > 0 && links.IsLinked(probeId, a.Id.Value)))
+        // 没有上报证书公钥的 Agent（旧版本）还不能被 Probe 连接：Probe 需要它来固定证书和派生敲门密钥
+        foreach (AgentRecord agent in agents.Where(a => a.Status == NodeStatus.Active && a.PublicHost.Length > 0 && a.TlsPublicKey is { Length: > 0 } && links.IsLinked(probeId, a.Id.Value)))
         {
             result.Agents.Add(new AgentEndpoint
             {
@@ -167,7 +168,7 @@ public sealed partial class AgentService
                 Ipv6Host = agent.Ipv6Supported && agent.Ipv6Host.Length > 0 ? agent.Ipv6Host : null,
                 TcpPort = agent.ProbeTcpPort,
                 UdpPorts = [.. agent.ProbeUdpPorts],
-                Spki = Convert.ToBase64String(agent.TlsSpki),
+                PublicKey = Convert.ToBase64String(agent.TlsPublicKey!),
             });
         }