[TPM] Phase 5: Validation & Documentation

[Vladush]

Ensuring fail-safes are airtight.

• Testing: Add unit tests for SecureBuffer and simulate the dlopen fallback path (what happens if the .so is missing).
• Threat Model Update: Document the blast-radius changes and the PCR-binding risks on kernel updates.