feat!: pre-handshake knock on the agent TCP ports; probes get the agent certificate public key [CI]

backend/tests/MoShiro.TestSupport/ProbeSimulator.cs

@@ -20,6 +20,7 @@ namespace MoShiro.TestSupport;
 public sealed class ProbeSimulator : IAsyncDisposable
 {
     private readonly NodeIdentity _identity;
+    private byte[]? _agentKey;
     private readonly RpcRouter<ProbeSimulator> _router;
     private readonly ConcurrentDictionary<Guid, TaskCompletionSource> _acks = new();
     private readonly ConcurrentDictionary<uint, EchoCollector> _echoes = new();
@@ -65,11 +66,12 @@ public sealed class ProbeSimulator : IAsyncDisposable
 
     public long NowUs() => (TimeProvider.System.GetTimestamp() - _origin) * 1_000_000 / TimeProvider.System.TimestampFrequency;
 
-    public async Task ConnectAsync(string host, int controlPort, byte[] agentSpkiSha256, int udpPort, NodeId agentId, TimeProvider? time = null, CancellationToken ct = default)
+    public async Task ConnectAsync(string host, int controlPort, byte[] agentPublicKey, int udpPort, NodeId agentId, TimeProvider? time = null, CancellationToken ct = default)
     {
         _agentId = agentId;
-        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(host, controlPort, agentSpkiSha256, _identity, ProbeId, "0.0.0-sim", 8 << 20, time ?? TimeProvider.System, ct);
+        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(host, controlPort, agentPublicKey, _identity, ProbeId, "0.0.0-sim", 8 << 20, time ?? TimeProvider.System, ct);
         _info = info;
+        _agentKey = agentPublicKey;
         _udp = new UdpClient(new IPEndPoint(IPAddress.Loopback, 0));
         _agentUdp = new IPEndPoint(IPAddress.Parse(host), udpPort);
         _rpc = new RpcSession<ProbeSimulator>(transport, _router, this, time ?? TimeProvider.System);
@@ -152,6 +154,7 @@ public sealed class ProbeSimulator : IAsyncDisposable
         using var client = new System.Net.Sockets.TcpClient();
         await client.ConnectAsync(IPAddress.Loopback, tcpPort, ct);
         Stream stream = client.GetStream();
+        await stream.WriteAsync(Knock.Build(Knock.DeriveKey(_identity, _agentKey!), TimeProvider.System.GetUtcNow().ToUnixTimeMilliseconds()), ct); // 预握手敲门
         if (tls)
         {
 #pragma warning disable CA5359 // 测试：Agent 的证书是自签名的，这里只验证数据面