feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/tests/MoShiro.TestSupport/AgentSimulator.cs

@@ -18,6 +18,7 @@ namespace MoShiro.TestSupport;
 public sealed class AgentSimulator : IAsyncDisposable
 {
     private readonly NodeIdentity _identity;
+    private readonly NodeIdentity _tlsKey = NodeIdentity.Generate();
     private readonly ClientWebSocket _socket = new();
     private readonly ConcurrentDictionary<Guid, TaskCompletionSource<bool>> _acks = new();
     private readonly ConcurrentDictionary<long, TaskCompletionSource<RpcMessage>> _responses = new();
@@ -71,6 +72,9 @@ public sealed class AgentSimulator : IAsyncDisposable
 
     public byte[] PublicKey => _identity.PublicKeySpki;
 
+    /// <summary>hello 里上报的 TLS 证书公钥（Probe 用它固定证书、派生敲门密钥）。</summary>
+    public byte[] TlsPublicKey => _tlsKey.PublicKeySpki;
+
     /// <summary>用这个节点的私钥为认证随机数签名（可以冒充别的节点 ID：用来测试服务端的校验）。</summary>
     public byte[] SignAuth(NodeId claimedNode, string nonce) => _identity.Sign(SignaturePurpose.Auth, claimedNode.Value, nonce);
 
@@ -147,7 +151,7 @@ public sealed class AgentSimulator : IAsyncDisposable
         var meta = JsonSerializer.SerializeToElement(
             new AgentHelloMeta
             {
-                TlsSpki = Convert.ToBase64String(RandomNumberGenerator.GetBytes(32)),
+                TlsPublicKey = Convert.ToBase64String(_tlsKey.PublicKeySpki),
                 Addresses = Addresses is null ? null : [.. Addresses],
                 ProbeTcpPort = 7443,
                 ProbeUdpPorts = [7443],