feat(attestation): add guarded local debug mode

[thinksyncs]

Summary

• Add a guarded Mac-friendly debug path for local agent-to-agent testing.
• Harden the standalone SNP and TDX module dependency and release gates.

Changes

• Add --debug-simple with signed simulated evidence, loopback-only transport, and explicit debug restrictions.
• Update nested attestation dependencies and Dependabot coverage.
• Add a reusable vulnerability gate that rejects any x/crypto/openpgp import while retaining package-level govulncheck.
• Document the debug mode, module boundaries, GO-2026-5932 status, and remaining qualification limits.

Testing

• go test ./examples/a2a-multiprocess
• SNP and TDX: go mod tidy -diff, go mod verify, go test -race -count=1 ./..., and go vet ./... with GOWORK=off
• SNP and TDX vulnerability gate with Go 1.26.6
• Negative control with an injected x/crypto/openpgp test import
• shellcheck and actionlint
• git diff --check

Notes

• SNP and TDX remain experimental and are not production-ready. Live hardware qualification is not included.
• TDX still lacks a successful strict collateral fixture.
• GO-2026-5932 remains a module-only notice with no fixed version. openpgp is not imported; the new gate blocks future imports without suppressing the notice.