probe: add native OpenWrt deployment and signed automatic updates [CI]

backend/src/MoShiro.Backend.Application/Admin/JoinTokenService.cs

@@ -8,7 +8,7 @@ namespace MoShiro.Backend.Application;
 public sealed record CreateJoinTokenRequest(string? Note, IReadOnlyList<string>? Labels, bool AutoApprove, int MaxUses, int ExpiresInHours, string Role = JoinTokenService.AgentRole, string? CreatedBy = null);
 
 /// <summary>各个系统上的一行安装命令：Linux 用 bash、macOS 用 zsh、Windows 用 PowerShell。命令里只有一次性代码，节点名字默认取主机名；Agent 和 Probe 是同一份脚本，角色由代码决定。</summary>
-public sealed record InstallCommands(string Linux, string Macos, string Windows);
+public sealed record InstallCommands(string Linux, string Macos, string Windows, string Openwrt = "");
 
 /// <summary>
 /// 安装命令里除了一次性的码，还带的公开值：信任根的创世指纹（节点把它固定下来）、属主（允许授权这个节点 extension 的 passkey 凭证 id）、
@@ -16,7 +16,7 @@ public sealed record InstallCommands(string Linux, string Macos, string Windows)
 /// </summary>
 /// <param name="ComposeSha256">面板提供的这个角色的 compose 文件的 SHA-256（命令下载之后先核对）。</param>
 /// <param name="QuadletSha256">面板提供的这个角色的 Podman Quadlet 单元的 SHA-256。</param>
-public sealed record InstallPlan(string? Genesis, IReadOnlyList<string> Controllers, string ScriptShSha256, string ScriptPs1Sha256, string ComposeSha256 = "", string QuadletSha256 = "");
+public sealed record InstallPlan(string? Genesis, IReadOnlyList<string> Controllers, string ScriptShSha256, string ScriptPs1Sha256, string ComposeSha256 = "", string QuadletSha256 = "", string OpenwrtSha256 = "", string NativeChannel = "release");
 
 /// <summary>
 /// compose 安装：<c>Env</c> 是要存成 <c>.env</c> 的内容（只有公开的值），<c>Url</c> 和 <c>Sha256</c> 是 compose 文件的下载地址和哈希，
@@ -109,7 +109,10 @@ public sealed class JoinTokenService
             $"f=$(mktemp) && curl -fsSL '{baseUrl}/install' -o \"$f\" && echo \"{plan.ScriptShSha256}  $f\" | sha256sum -c - >/dev/null && {env} sh \"$f\"",
             $"f=$(mktemp) && curl -fsSL '{baseUrl}/install' -o \"$f\" && echo \"{plan.ScriptShSha256}  $f\" | shasum -a 256 -c - >/dev/null && {env} sh \"$f\"",
             $"$f = Join-Path $env:TEMP 'moshiro-install.ps1'; irm '{baseUrl}/install.ps1' -OutFile $f; if ((Get-FileHash $f -Algorithm SHA256).Hash -ne '{plan.ScriptPs1Sha256}') {{ throw 'the install script does not match its published hash' }}; "
-            + $"$env:MOSHIRO_SERVER='{baseUrl}'; $env:MOSHIRO_ROLE='{role}'; $env:MOSHIRO_CODE='{code}'; {psPin}iex (Get-Content -Raw $f)");
+            + $"$env:MOSHIRO_SERVER='{baseUrl}'; $env:MOSHIRO_ROLE='{role}'; $env:MOSHIRO_CODE='{code}'; {psPin}iex (Get-Content -Raw $f)",
+            role == ProbeRole && plan.Genesis is not null
+                ? $"f=$(mktemp) && (curl -fsS '{baseUrl}/install/openwrt.sh' -o \"$f\" || uclient-fetch -q -O \"$f\" '{baseUrl}/install/openwrt.sh') && echo \"{plan.OpenwrtSha256}  $f\" | sha256sum -c - >/dev/null && {env} MOSHIRO_CHANNEL='{plan.NativeChannel}' sh \"$f\" install"
+                : "");
     }
 
     /// <summary>