Deep attestation: full cryptographic chain verification (TPM2/SEV-SNP/TDX)

## Description

The current attestation validators perform structural validation (certificate parsing, chain length checks, field presence) but do not perform full cryptographic signature verification. The following TODOs remain in `src/verification/attestation.rs`:

1. **Full RSA/ECDSA signature verification** (line ~126): `validate_chain_structure()` checks certificate structure but does not verify cryptographic signatures in the chain
2. **TPM2 manufacturer OID** (line ~154): Check TPM manufacturer OID (2.23.133.x) in leaf cert extensions
3. **AMD ARK fingerprint** (line ~182): Compare root cert fingerprint against known AMD ARK fingerprint for SEV-SNP
4. **Intel root CA fingerprint** (line ~208): Compare root cert fingerprint against known Intel root CA for TDX
5. **Ed25519/ECDSA platform root-of-trust** (line ~627): Full signature verification against platform root-of-trust

## Requirements

- Parse and verify RSA-2048/4096 and ECDSA-P256/P384 signatures in certificate chains
- Validate TPM2 EK certificates against manufacturer root CAs
- Validate AMD SEV-SNP VCEK certificates against pinned AMD ARK/ASK root fingerprints
- Validate Intel TDX quotes against pinned Intel DCAP root CA fingerprints
- Reject chains with expired certificates, revoked intermediates, or unknown root CAs

## Success Criteria

- [ ] All certificate chain validation uses real cryptographic verification (not just structural checks)
- [ ] Test vectors from AMD, Intel, and TPM manufacturers pass/fail correctly
- [ ] Integration tests run against real hardware attestation quotes where available
- [ ] `cargo test` passes with zero regressions
- [ ] No `// TODO` comments remain in attestation.rs

## Testing (Principle V — real hardware required)

- Obtain real TPM2 EK certificates from test hardware and verify chain
- Obtain AMD SEV-SNP attestation reports from SEV-capable hardware
- Obtain Intel TDX quotes from TDX-capable hardware
- Test with deliberately invalid/expired/revoked certificates (must reject)
- Test with empty attestation (must downgrade to T0, not reject)

Start by reading the TODOs in src/verification/attestation.rs, especially validate_chain_structure() and the platform root-of-trust checks. Run cargo test to establish the baseline, then review the AMD, Intel, and TPM test-vector requirements and available hardware constraints. Done means cryptographic chain, root, expiry, revocation, and downgrade behavior are covered and cargo test passes without remaining TODOs.

Written by the indexing model from the issue text.