Add optional Runpod untrusted-caller lab

[noah-ing]

Summary

• add an opt-in Runpod CPU Serverless adversarial-caller lab under examples/runpod-untrusted-caller/, isolated from the core package and assurance claim
• keep TPM appraisal, broker/resource/receipt keys, policy, SQLite state, and final verification on the local controller; send only disposable holder material to the untrusted worker
• add strict RFC 8785/Ed25519-JWS experiment records, fake-transport CI, corrupt-output/key/timeout/duplicate/race regressions, immutable linux/amd64 worker handling, bounded cost controls, and unconditional name/identity-verified cleanup
• compose strict Runpod 2.12.0 template, GraphQL create, and REST get read-backs without treating provider metadata as attestation or runtime evidence
• fail closed before pricing, TPM preparation, or provider mutation unless the exact digest-pinned worker image passes an anonymous pull and hardened offline runtime preflight

Verification

• host: 146 core tests passed (15 Linux swtpm tests deselected), 280 lab tests passed (1 swtpm test deselected); core combined coverage was 88.22% against the measured 85% floor
• clean no-cache Docker/real-swtpm: 161 core tests and 281 lab tests passed; combined core coverage was 90.35%
• Ruff, formatting, mypy (13 core and 19 strict lab files), Bandit, package metadata/inventory/offline wheel smoke, pip-audit, detect-secrets, Compose validation, and isolated non-root worker smoke passed
• package verification found 18 expected wheel files and 81 allowlisted sdist files, with an offline isolated-wheel import smoke
• GitHub Verification and GitGuardian checks passed at 35c60503f3b8daf95c2868ed6eddb95765191c62

Live validation

The first bounded job exposed an unusable earlier image whose dependency lock was empty. It produced no worker response or signed record, and cleanup completed. The runner now rejects that class of image before any billable provider mutation.

A fresh bounded CPU Serverless run then completed using:

docker.io/ningwers2/attested-capability-broker-holder@sha256:ab2178d1a07f3ce99f884e6dbfe1e8d8e9003a7d2470fde9cf2ca778947c2306

The local controller verified real-swtpm appraisal evidence and the signed experiment record, including all 7 broker receipts and all 15 resource receipts. The transcript records 3 allowed and 12 denied attempts, 3 handler invocations, and 3 credential spends. In the eight-way race, exactly one attempt was allowed and seven were denied CREDENTIAL_SPENT, with one invocation and one spend. The endpoint and private template were removed; three consecutive read-backs found both absent, and account spend returned to $0/hour. Checksummed evidence remains outside Git and is not part of this PR.

Assurance boundary

Runpod, its control plane, queue, worker, network, metadata, and output remain untrusted. This lab tests application-level behavior against a remote untrusted caller. It does not attest Runpod or prove intended-image execution, key residency, TPM/agent co-location, TEE/runtime/network integrity, safe behavior, or exactly-once business execution. The self-contained JWS and bundled verifier establish internal signature consistency; attributing the record to a controller requires independently pinning its verification key. With that pin, the JWS authenticates only the configured local controller's observed transcript.