orb(attest): attested-run harness with pluggable attester — sample now, SNP by config

[JSONbored]

Context

Part of the attested-evaluation epic (#8534). The envelope schema, structural validator, and report-data binding helper are done as pure functions (#8541, 64-byte binding per #9140), but nothing runs an attested backtest replay end to end. Confidential Containers ships a no-TEE sample-attester path, so the entire harness can be built and CI-tested now, on existing hardware — real SNP hardware then becomes a configuration change, not new code. #8537 is rescoped to "first real attested run on SNP CoCo"; this issue is its software prerequisite.

Requirements

1. Pluggable attester interface with two implementations: sample (dev/no-TEE; deterministic fake report) and snp (real report via the CoCo attestation-agent path). Selected by config. The envelope records which attester produced it in a structural field — a sample-attested envelope must be impossible to present as real attestation (verifier fails it by default; see the verifier CLI issue).
2. Runner: packages the existing backtest replay as a job pinned to the reproducible runner image's recorded digest (see the pinned-image issue), executes it, collects the report through the attester interface, and binds report_data per the calibration: attestation-evidence envelope — schema, pure structural validator, and report-data binding helper #8541 helper over corpus checksum + code SHAs + a freshness nonce.
3. Persistence: the envelope is stored beside the backtest-run record (migration as needed, contiguous numbering), linked by run id.
4. Fail-closed: if the runtime claims a TEE runtime class but report collection fails, the run is recorded attestation_failed — never silently unattested-ok. Both arms tested.
5. CI runs the full E2E with the sample attester — no hardware assumptions anywhere in tests.

Deliverables

• Attester interface + both implementations, runner, migration, and tests: attester swap by config, fail-closed arm, binding correctness against the calibration: attestation-evidence envelope — schema, pure structural validator, and report-data binding helper #8541 helper, sample-vs-snp distinguishability.

Expected outcome

while hardware is pending: attested-run E2E green in CI under the sample attester. On SNP day: flip attester config, record real measurements, produce the first real envelope (#8537).

[linear-code]

JSO-6385