feat(guest-agent): collect on-demand GPU attestation evidence - #1112

The boot gate owned the only code that knows how to call `nvattest`: the
argument shape, the proxy-URL rules that stop a misconfigured value smuggling a
different collateral endpoint past `{proxy}/ocsp`, and the nonce check. The
guest agent is about to need all three for on-demand attestation, and a second
copy is a second set of bugs.

The crate keeps the invocation and drops the appraisal, because the boot gate
and a runtime liveness check want different answers from the same bytes:
`check_nonce` only asserts that every claim answers the nonce it was given, and
device counts, CC state and application policy stay with the caller.

`run` and `attest` are separate so the boot gate keeps persisting stdout before
it judges the exit status -- a failed appraisal is exactly when the evidence is
worth having on disk. `run_command` also gains `kill_on_drop`, so a wedged tool
no longer outlives the timeout that gave up on it.

The response documented one reason a relying party must not trust it -- an
NVIDIA report binds the device and nonce but not the TD, so it is relayable.
There is a blunter reason that comes first, and the docs did not say it.

`nvattest --verifier local` returns the verifier's *conclusion*, not the GPU's
signed report. The repo's own captured H100 output shows the detached EAT is
`alg:none` with an empty signature, issued by `NVAT-LOCAL-VERIFIER`, and claims
such as `x-nvidia-gpu-attestation-report-signature-verified` are assertions
about a check already performed; the signed SPDM report and certificate chain
are consumed during verification and never appear in the output. A third party
handed this JSON therefore has nothing to check at all, relay or no relay.

Worth being precise about because it also explains why the boot-time path is
sound with the same unsigned artifact: that evidence is trusted not because it
self-authenticates but because measured dstack code pinned by `os_image_hash`
appraised it before any workload existed, with sha256 of the exact bytes in
RTMR3 under the quote. The appraiser is what is trusted, not the JSON.

A test pins the format claim against the fixture, so an SDK that starts signing
the EAT fails here rather than leaving the API docs quietly wrong.

`AttestGpu` returned only `nvattest attest --verifier local` output, which is
the verifier's conclusion. That conclusion is unsigned -- its detached EAT is
`alg:none` from `NVAT-LOCAL-VERIFIER` -- so a third party handed it had nothing
to check, and the API could only ever be a local health check.

`collect-evidence` emits what the GPU actually signed: per device, the base64
SPDM attestation report and its certificate chain, over the caller's nonce. The
response now carries that as `evidence`, so a relying party can verify the chain
to NVIDIA's root, check the report signature, confirm the nonce inside the
report, and compare measurements against NVIDIA's RIM documents -- with its own
verifier, trusting nothing this CVM says.

The local verdict is still useful to a caller inside the CVM, which is in the
agent's trust domain and usually just wants the answer, so it stays as
`appraisal`. Splitting the two is the RATS distinction: evidence is what the
attester produces, appraisal is a verifier's opinion about it, and only the
first travels.

The agent collects once and appraises those exact bytes via
`--gpu-evidence-source=file` rather than running two independent attestations,
so the two halves provably describe the same report. The SDK independently
rejects an evidence file whose nonce does not match the appraisal nonce.

This does not change what the evidence proves about *placement*: an NVIDIA
report binds the device and the nonce and nothing else, so it stays relayable
from a genuine remote GPU until TDISP/TEE-IO. What changes is that the part a
third party can check is now actually reaching them.