feat(tee): OPAQUE managed runtime provider (explicit opt-in)

[imran-siddique]

Implement the OPAQUE Confidential Runtime provider, explicit opt-in via OPAQUE_ATTESTATION_URL, never auto-detected. Currently a stub (detect() returns False).

[imran-siddique]

Reopening: this was closed in error by PR #21. The OPAQUE managed-runtime provider is not implemented. PR #21 delivered the SEV-SNP backend (#2) and the quote-appraisal verifier (#6), not OPAQUE.