feat(attestation): cryptographically verify NVIDIA GPU evidence end to end #537

Problem

The runtime has an NRAS post-appraisal client from #125, while STATUS.md still lists gpu-cc as planned. There is no tracked implementation gate proving that genuine NVIDIA confidential-GPU evidence is collected, cryptographically appraised, bound to the workload or channel key, and enforced fail closed.

A mocked NRAS response or a structurally valid GPU claim is not sufficient for a hardware-attested GPU claim.

Scope

Implement and validate the NVIDIA GPU evidence path independently of any particular customer, model, event, or deployment.

Acceptance criteria

• Collect genuine confidential-GPU evidence on a supported NVIDIA GPU in CC mode.
• Authenticate the appraisal result and verifier identity using the documented NVIDIA trust path.
• Bind freshness and the workload or ephemeral transport key into the evidence exchange.
• Reject absent, stale, malformed, contraindicated, measurement-mismatched, and key-substituted evidence.
• Keep software-only and structural evidence explicitly below hardware assurance.
• Carry the verified GPU appraisal and relevant evidence digests into the runtime context and TRACE output without carrying sensitive payloads.
• Record one reproducible real-hardware validation run with hardware, driver and firmware versions, commits, verifier output, and tampered negative cases.
• Update STATUS.md and LIMITATIONS.md only after the real-hardware run passes.

Relationship to existing work

#125 covers NRAS REST integration and mocked response handling. This issue covers the hardware-backed collection, cryptographic trust, binding, enforcement, and reproducible validation required to turn that client into a defensible gpu-cc assurance path.