feat: CI registers release manifests without a token; the panel verifies the CI signature instead [CI]

backend/openapi/v1.json

@@ -5020,6 +5020,67 @@
         }
       }
     },
+    "/api/release/offer": {
+      "post": {
+        "tags": [
+          "release"
+        ],
+        "summary": "Register a release manifest that carries a valid CI signature (no token needed)",
+        "operationId": "release_offer",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PublishReleaseRequest"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "201": {
+            "description": "Created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ReleaseDto"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Bad Request",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Forbidden",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          },
+          "409": {
+            "description": "Conflict",
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProblemDto"
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/api/agent/v1/enroll": {
       "post": {
         "tags": [
@@ -9384,6 +9445,9 @@
     {
       "name": "ops"
     },
+    {
+      "name": "release"
+    },
     {
       "name": "agent"
     }