orb(attest): envelope verifier CLI — AMD cert chain, measurement, report_data re-derivation

[JSONbored]

Context

Part of the attested-evaluation epic (#8534). Trustless scoring means third parties verify attested runs — the verifier is the half that matters to everyone who isn't us, and it needs zero TEE hardware to build or run. The structural validator exists (#8541); the full cryptographic verification path does not. #8538's docs walkthrough will point at this CLI.

Requirements

1. A CLI (scripts/verify-attested-run.ts or a package bin) taking an envelope plus an expected-values manifest, verifying:
   • (a) SNP report signature chain to AMD's ARK/ASK/VCEK with pinned, vendored root certificates (no network by default; explicit --fetch-vcek opt-in), surfacing TCB status;
   • (b) launch measurement equals the expected pinned digest from the manifest;
   • (c) report_data re-derived from the envelope's claimed corpus checksum + SHAs + nonce matches the report's 64-byte field exactly;
   • (d) freshness/nonce validity.
2. Sample-attester envelopes fail by default with an explicit "dev attestation — not evidence" reason; --allow-sample exists for dev workflows only.
3. Exit-code contract (0 verified / distinct non-zero per failure class) so CI, docs, and third-party scripts can consume it.
4. Test vectors: at least one recorded real SNP report fixture, plus synthetic negatives — bad signature, wrong measurement, wrong report_data, stale TCB, sample-attester rejection.

Deliverables

• The CLI + vendored cert material + fixtures + tests covering every failure class above.

Expected outcome

Anyone can take a published envelope and independently answer "did this exact code run on this exact corpus inside genuine SNP hardware" — without trusting us or contacting us.

[linear-code]

JSO-6386