Add a distributed enclave attestation protocol

[flo2517]

Prove, to anyone and not just to the tenant, that a workload is genuinely running inside a valid TEE on the provider it claims. Without distributed attestation, #60's confidentiality guarantee rests on the provider's own word, which is precisely the trust this roadmap removes.

Blocked by: ADR-019 (see ADR-012 §6) — no implementation before acceptance. Ships with #60.

Acceptance criteria:

• attestation evidence is verified against a vendor root of trust, and the accepted roots plus their revocation path are governed on-chain rather than hard-coded;
• verification is performed by independent parties, not by the provider being attested and not by a single Control Plane — Network Validators are the natural verifiers and their existing committee, quorum, and dispute machinery is reused rather than duplicated;
• attestation results land on-chain as bounded integer summaries plus a payload hash, per ADR-011 §3; raw quotes stay off-chain;
• attestations are fresh and replay-resistant, carrying a nonce and a deadline per ADR-012 §4 — a valid quote from last month proves nothing about now;
• enclave measurement is bound to the specific workload and provider, so a valid attestation cannot be relayed on behalf of a different machine or a different image;
• a failed, stale, or unverifiable attestation degrades the workload explicitly and is reflected in the provider's reputation; degraded verifier quorum is reported honestly, not as success;
• vendor-root compromise has a defined response that does not require a runtime upgrade to execute;
• tests cover a valid attestation, a replayed quote, a relayed quote from another machine, a revoked vendor root, an expired attestation, a provider refusing to attest, and verifier quorum below threshold.

---

Original request (FR, preserved verbatim):

Mettre en place un système de preuve que le workload tourne bien dans un environnement TEE valide.