probe: add native OpenWrt deployment and signed automatic updates [CI]

ci/build-dev-image.sh

@@ -183,6 +183,20 @@ for tag in "$image_version-$arch"; do
   echo "pushed development image $repository:$tag"
 done
 
+# Reuse the static Probe/enrollment binaries already built above; do not compile again.
+# Publish before the multi-arch image offer wakes online native nodes.
+if [[ "$component" == probe ]]; then
+  buildah rm "moshiro-openwrt-extract-$arch" >/dev/null 2>&1 || true
+  native_container="$(buildah from --arch "$arch" --name "moshiro-openwrt-extract-$arch" "$local_image")"
+  native_dir="$work/openwrt"
+  mkdir -p "$native_dir"
+  native_mount="$(buildah mount "$native_container")"
+  cp "$native_mount/usr/local/bin/moshiro-probe" "$native_mount/usr/local/bin/fleet-enroll" "$native_dir/"
+  buildah unmount "$native_container" >/dev/null
+  buildah rm "$native_container" >/dev/null
+  bash "$root/ci/publish-openwrt.sh" dev "$node_rid" "$native_dir"
+fi
+
 # Agent and Probe manifests are signed after both architecture-specific images
 # have been pushed. Backend is still a single-architecture development image.
 if [[ "$component" == backend && -n "${RELEASE_SIGNING_KEY:-}" ]]; then