security: verify attestation report signatures (VCEK / DCAP / EK)

[imran-siddique]

Tracked follow-up from the June 2026 org-wide security hardening review. Wave 1/2 fixes are merged and published; this is remaining hardening.

The verifier currently treats the platform report signature as unverified (documented in LIMITATIONS.md). Implement real report-signature verification: SEV-SNP VCEK chain from AMD KDS; Intel TDX Quote via QVL/PCS; TPM AK cert + tpm2_checkquote. Needs vendor libraries + real-hardware test vectors. Until then status must not claim hardware-backed verification.

[imran-siddique]

Status: SNP report-signature + VCEK->ASK->ARK chain verification is implemented and fail-closed in PR #386 (tested against a synthetic chain: valid verifies, tampered fails closed, wrong pinned ARK fails closed; one test skipped pending a real Azure SNP fixture). TDX (DCAP) is being scaffolded in a separate draft PR. TPM EK chain still TODO. Real Azure SNP/TDX fixtures come from the capture scripts (Product/Platform/attestation-capture/ in the notes store).