fix(ci): build native node images and add compose files [CI]

Restore with PublishAot so agent and probe images contain NativeAOT
binaries instead of a launcher that needs a .dll, fail the build when the
binary is too small, add agent and probe compose files, and document the
[CI] marker in AGENTS.md.

AGENTS.md

@@ -7,6 +7,7 @@ Monitor is a self-hosted network path quality monitor. Backend coordinates Agent
 ## Branch and workspace safety
 
 - Treat `main` as the stable release branch and `dev` as the integration branch. Keep ordinary implementation work on `dev` or a feature branch; integrate into `main` through a pull request.
+- A push to `main` builds images only if its commit message contains `[CI]` (for a merged PR, put it in the PR or merge commit title). Without `[CI]` nothing is built; use `[CI SKIP]` to skip the pipeline entirely. When squashing or pushing to `main`, add `[CI]` unless a build is explicitly not wanted.
 - Before editing, inspect `git status`. Preserve pre-existing user changes: do not reset, clean, stash, or include unrelated files in a commit.
 - Do not commit credentials, API keys, registry passwords, or generated runtime data. CI credentials belong in Woodpecker secrets.
 - Keep development OCI images in the `monitor-dev/` repository path and release images in `monitor/`. Do not let a development build overwrite release tags such as `latest`.

packaging/compose/.gitignore

@@ -0,0 +1 @@
+.data/

packaging/compose/agent/compose.yaml

@@ -0,0 +1,33 @@
+# Agent：配置和身份都放在同目录的 .data/（挂载到容器的 /etc/monitor）。
+#
+# 第一次使用：
+#   mkdir -p .data && sudo chown 1654:1654 .data        # 容器以 UID/GID 1654 运行
+#   MONITOR_JOIN_TOKEN=<加入令牌> MONITOR_SERVER=https://<backend> MONITOR_AGENT_NAME=<名字> \
+#     docker compose run --rm --entrypoint /usr/local/bin/fleet-enroll agent \
+#     --server "$MONITOR_SERVER" --join "$MONITOR_JOIN_TOKEN" --name "$MONITOR_AGENT_NAME" --identity-dir /etc/monitor/agent-id
+#   再在 .data/agent.json 里写（fleet.identity_dir 要和上面一致）：
+#   {"fleet":{"server":"https://<backend>","identity_dir":"/etc/monitor/agent-id"},"listen":{"bind":"0.0.0.0"},"limits":{"max_total_mbps":100,"max_total_pps":10000}}
+#   docker compose up -d
+#
+# 更新：改 MONITOR_VERSION（或 MONITOR_IMAGE），再 docker compose pull && docker compose up -d。.data 不动，身份和历史都保留。
+services:
+  agent:
+    image: ${MONITOR_IMAGE:-registry.oeo.one/monitor/monitor-agent}:${MONITOR_VERSION:-0.1.1}
+    container_name: monitor-agent
+    restart: unless-stopped
+    init: true
+    # Probe 要直连 Agent 的 7443（TCP+UDP）和 7444（TCP），用宿主网络，不做端口映射
+    network_mode: host
+    volumes:
+      - ./.data:/etc/monitor
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    # 要做 ICMP 测量时打开：
+    # cap_add:
+    #   - NET_RAW
+    stop_grace_period: 20s

packaging/compose/probe/compose.yaml

@@ -0,0 +1,28 @@
+# Probe：身份配置 probe.json 和 Agent 列表缓存 agents.json 都放在同目录的 .data/（挂载到容器的 /etc/monitor）。
+#
+# 第一次使用：
+#   mkdir -p .data && sudo chown 1654:1654 .data        # 容器以 UID/GID 1654 运行，需要读写这个目录
+#   在管理端创建 Probe，下载一次性身份配置，保存为 .data/probe.json（含私钥，权限 600，不要提交到版本控制）
+#   docker compose up -d
+#
+# 更新：改 MONITOR_VERSION（或 MONITOR_IMAGE），再 docker compose pull && docker compose up -d。.data 不动。
+services:
+  probe:
+    image: ${MONITOR_IMAGE:-registry.oeo.one/monitor/monitor-probe}:${MONITOR_VERSION:-0.1.1}
+    container_name: monitor-probe
+    restart: unless-stopped
+    init: true
+    network_mode: host
+    volumes:
+      - ./.data:/etc/monitor
+    read_only: true
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,size=64m,mode=1777
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    # 要做 ICMP 测量时打开：
+    # cap_add:
+    #   - NET_RAW
+    stop_grace_period: 20s

packaging/container/Agent.NativeBuild.Containerfile

@@ -7,8 +7,9 @@ ARG MONITOR_COMMIT=
 ARG MONITOR_BUILT_AT=
 ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
 COPY restore/backend/ ./
-RUN dotnet restore agent/src/Monitor.Agent -r linux-x64 --artifacts-path /artifacts \
+# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
-    && dotnet restore fleet/tools/fleet-enroll -r linux-x64 --artifacts-path /artifacts
+RUN dotnet restore agent/src/Monitor.Agent -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts \
+    && dotnet restore fleet/tools/fleet-enroll -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
@@ -19,7 +20,9 @@ RUN dotnet publish agent/src/Monitor.Agent -m:3 -c Release -r linux-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/enroll
-RUN test -x /out/agent/monitor-agent && test -x /out/enroll/fleet-enroll
+# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
+RUN test -x /out/agent/monitor-agent && test -x /out/enroll/fleet-enroll \
+    && test "$(stat -c%s /out/agent/monitor-agent)" -gt 2000000 && test "$(stat -c%s /out/enroll/fleet-enroll)" -gt 2000000
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra
 

packaging/container/Probe.NativeBuild.Containerfile

@@ -7,14 +7,17 @@ ARG MONITOR_COMMIT=
 ARG MONITOR_BUILT_AT=
 ENV MONITOR_TAG=$MONITOR_TAG MONITOR_COMMIT=$MONITOR_COMMIT MONITOR_BUILT_AT=$MONITOR_BUILT_AT
 COPY restore/backend/ ./
-RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 --artifacts-path /artifacts
+# restore 也要带 PublishAot：不然不会还原 ILCompiler，之后 --no-restore 的发布就悄悄变成「裁剪过的框架依赖程序」
+RUN dotnet restore probe/src/Monitor.Probe -r linux-x64 -p:PublishAot=true --artifacts-path /artifacts
 
 COPY source/backend/ ./
 RUN dotnet publish probe/src/Monitor.Probe -m:3 -c Release -r linux-x64 \
     --self-contained true --no-restore -p:PublishAot=true -p:UseAotAnywhere=false \
     -p:UseAppHost=true -p:StripSymbols=true \
     -p:DebugType=none -p:DebugSymbols=false --artifacts-path /artifacts -o /out/probe
-RUN test -x /out/probe/monitor-probe
+# 原生程序有几 MB；几十 KB 的是只会去找 .dll 的启动器
+RUN test -x /out/probe/monitor-probe \
+    && test "$(stat -c%s /out/probe/monitor-probe)" -gt 2000000
 
 FROM mcr.microsoft.com/dotnet/runtime-deps:10.0-noble-chiseled-extra