GPU attestation gate follow-ups: commit to RTMR, enforce CC mode, cache OCSP, SNP

#751 の設計コンテキストと、#765 および Dstack-TEE/meta-dstack#83 で参照されている既存の attestation 作業から始めてください。system-ready 周辺の dstack-util のイベントパスを追跡し、SNP と vTPM の統合境界を特定してください；SNP が RTMR に依存せず、同じリモート検証可能なバインディングを持てば完了です。

Context

The GPU attestation gate landed in #765 and Dstack-TEE/meta-dstack#83. It runs local nvattest before key provisioning, and fails closed if an attached GPU can't attest. That's a good foundation, but a few follow-ups remain before it's a complete, remotely-verifiable trust story. Design context is in #751.

Follow-ups

• Commit the attestation result into an RTMR, not report_data. Today it only lands in a file under /run, and the planned binding would put it in report_data. But report_data can be set by any app to any value. So a VM with no GPU could copy a real VM's value and pass, and a verifier couldn't tell the two apart. If dstack-util instead emits a gpu-attestation event before system-ready, the value lands in RTMR3, which is measured and append-only, so KMS and remote verifiers can actually trust it. It also closes a gap we have today: a no-GPU VM with verify_gpu=true currently looks identical to a verified one.

• Require CC mode on, and reject DEVTOOLS. We run nvattest with no policy file, so success comes down to the x-nvidia-overall-result claim. That claim proves the GPU is genuine and its measurements match, but it does not require CC mode to be on. That means a GPU in DEVTOOLS mode, where memory encryption is off, can still pass. A small Rego policy that requires CC on and debug off would close this.

• Don't let OCSP turn into a boot DoS. Local verify makes a live call to NVIDIA's OCSP endpoint at boot (that's what the chrony step is for). Because the gate is fail-closed, anyone who blocks that endpoint stops every GPU VM from booting. That includes a malicious host, but also an egress-restricted or air-gapped deployment, or plain NVIDIA downtime. Caching or stapling the OCSP response would avoid it.

• Add SNP support. The RTMR approach doesn't port to SEV-SNP, because SNP has no runtime measurement register: its identity comes from launch-time HOST_DATA. So SNP will need a vTPM before the same binding works. Worth tracking now, otherwise SNP quietly ships a weaker binding.

Refs: #765, Dstack-TEE/meta-dstack#83, #751.