[CRE] Confidential workflow execution

Adds support for executing workflow WASM binaries inside TEE enclaves instead of locally on the node. The workflow engine detects confidential workflows via on-chain attributes and delegates execution to an enclave via a new LOOP capability.

Corresponding confidential-compute PR: https://github.com/smartcontractkit/confidential-compute/pull/279
Corresponding chainlink-common PR: https://github.com/smartcontractkit/chainlink-common/pull/1899
Corresponding chainlink-common follow-up PR: https://github.com/smartcontractkit/chainlink-common/pull/1948

Split from #21603 into reviewable pieces.

PR chain

PRs 1, 2, 4 are independent and can merge in any order. PR 5 depends on 1, 2, 4.

• #21638 [1/4] Gateway handler for confidential relay
• #21639 [2/4] Relay DON node handler
• #21640 [3/5] Launcher fix Closed. Relay DON configured as workflow DON instead (CC E2E config change).
• #21641 [3/4] ConfidentialModule, config, DB migration, syncer routing
• #21642 [4/4] Wire into CRE, system test support

Components

• Gateway handler: Fans out enclave requests to relay DON nodes, F+1 quorum aggregation
• Relay DON handler: Validates Nitro attestation, proxies to VaultDON and capabilities
• ConfidentialModule: Strategy pattern replacing local WASM execution with enclave dispatch
• Syncer routing: Detects confidential workflows via attributes, routes to ConfidentialModule
• Config/DB: New TOML config for relay, DB column for workflow attributes

Start by reading the PR chain and the listed components, especially #21641 for ConfidentialModule, config, DB migration, and syncer routing, followed by #21642 for CRE wiring and system-test support. Review the corresponding confidential-compute and chainlink-common PRs before determining which remaining piece is unclaimed; done means the relevant PR-chain item is integrated and its enclave execution path is supported.