feat(distributed): 支持单主控多节点部署和停服迁移

复用现有 k3s 调度和 Job 生命周期，增加 worker 接入与批准、受保护节点身份、归档传输、持久迁移锁及活动 PVC 切换；同步管理员 API、CLI、面板和隔离规则。分布式模式默认关闭，保持单机兼容。

验证：Go 全量测试与 vet；面板 874 个测试、lint/build；Linux VM 安装器测试、清单服务端 dry-run、网络命名空间防火墙实测。A/B/C 三机 WireGuard、Velocity 和迁移验收仍待完成。

cmd/felis/node_probe.go

@@ -0,0 +1,56 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"net"
+	"time"
+)
+
+// A trusted probe runs with the same server labels and security context before node admission.
+func cmdNodeProbe(args []string, stdout, stderr io.Writer) int {
+	fs := flag.NewFlagSet("node-probe", flag.ContinueOnError)
+	fs.SetOutput(stderr)
+	listen := fs.String("listen", "", "listen and print observed source addresses (admission only)")
+	var open, closed multiFlag
+	fs.Var(&open, "open", "required reachable host:port")
+	fs.Var(&closed, "closed", "required blocked host:port")
+	if err := fs.Parse(args); err != nil {
+		return 2
+	}
+	if *listen != "" {
+		l, err := net.Listen("tcp", *listen)
+		if err != nil {
+			fmt.Fprintln(stderr, err)
+			return 1
+		}
+		defer l.Close()
+		for {
+			c, err := l.Accept()
+			if err != nil {
+				return 1
+			}
+			fmt.Fprintln(stdout, "felis-probe-source", c.RemoteAddr().String())
+			c.Write([]byte("felis-probe\n"))
+			c.Close()
+		}
+	}
+	time.Sleep(3 * time.Second)
+	for _, check := range []struct {
+		addresses []string
+		wantOpen  bool
+	}{{open, true}, {closed, false}} {
+		for _, addr := range check.addresses {
+			c, err := net.DialTimeout("tcp", addr, 2*time.Second)
+			if c != nil {
+				c.Close()
+			}
+			if (err == nil) != check.wantOpen {
+				fmt.Fprintf(stderr, "node-probe: %s open=%t, expected %t\n", addr, err == nil, check.wantOpen)
+				return 1
+			}
+		}
+	}
+	return 0
+}