Tracking: AWS EC2 NitroTPM attestation platform support

首先审查 Dstack-TEE/dstack#753 和 Dstack-TEE/meta-dstack#79，包括 docs/aws-attested-instance-security-evaluation.md 以及列出的 CI 结果。完成的标准是先合并 #753，更新 meta#79 的子模块，并忽略指定的预先存在的 CodeQL 警报。

Tracks the two PRs that add the AWS EC2 NitroTPM attestation platform to dstack (account-admin-untrusted threat model).

PRs

• Dstack-TEE/dstack#753 — core implementation: NitroTPM attestation-document parsing/verification, PCR14 launch + PCR23 runtime measurement, KMS key release without AWS KMS, verifier + auth-simple/auth-eth support, and SDK updates. Base master, one squashed commit (504e3420).
• Dstack-TEE/meta-dstack#79 — Yocto layer: the dstack-aws kernel fragment (NVMe/ENA root, EFI/GPT, serial console, TPM CRB) and the tpm2-tss guest build dep. Base main (a1aa04e). Depends on #753.

Status

Both are rebased onto their latest base and MERGEABLE. On #753 every functional CI job is green (rust-checks, sdk-tests, kms, verifier, gateway, prek, reuse-lint); meta#79 CI is green.

Design notes for reviewers

• Integrates like AMD SEV-SNP, not with bespoke surface. A verified NitroTPM attestation has no TDX/SNP-style TCB surface, so it is normalized to tcbStatus = "UpToDate" and passes the unchanged on-chain contract — no AWS-specific on-chain field.
• AWS key release is opt-in: aws_nitro_tpm_key_release = false by default in kms.toml, mirroring sev_snp_key_release (fail-closed for the new, weaker mode).
• App is trusted post-launch, exactly as on TDX/SNP — no compose-security filter or device sandbox; integrity rests on measurement + non-resettable PCR14. Rationale in docs/aws-attested-instance-security-evaluation.md.
• GetPlatform was folded into AppInfo.attestation rather than adding a new endpoint.

Before merge

• Merge order: #753 first, then bump the submodule and merge meta#79.
• Dismiss the CodeQL alerts flagged on #753's diff — they are pre-existing, in files this PR doesn't touch (surfaced only because the squashed diff is large). Notably sodiumbox/src/lib.rs:62 "hard-coded cryptographic value" is the HSalsa20 zero nonce, i.e. the correct NaCl crypto_box construction (false positive); the rest are pre-existing in ra-rpc, http-client, and sdk/go/ratls.

Follow-ups (post-merge, optional)

• Share the X25519+AES-GCM envelope (encrypt_for_x25519_recipient in KMS + dh_decrypt in the guest) via a small lib crate — deferred because dstack-util is a binary crate.
• Confirm whether the tpm2-tss build dep in meta#79 is actually needed (the guest drives the TPM via the in-tree tpm2 crate over /dev/tpmrm0).