feat: use complete TDINFO hash for TCB mappings

[haitaohuang]

Summary

Implement the one-hash TCB mapping design proposed in #908:

• use SHA384(TDINFO) over the complete unmasked TDINFO as the mapping key;
• break the RTMR2 circular dependency by measuring canonical policyData with only servtdTcbMapping redacted;
• verify the signed mapping with the RTMR1-bound policy issuer chain;
• authenticate migration and rebinding continuity through SERVTD_EXT rather than host-supplied Init_TDINFO;
• resolve source initial/current hashes through the authenticated source JSON mapping and reject lookup misses, SVN rollback, and nonzero SERVTD_ATTR;
• preserve cumulative mapping history in migtd-hash, including multiple release hashes assigned to the same SVN.

The legacy outer policy signature is ignored because policy integrity is established by RTMR2. The existing wire Init_TDINFO field remains for framing compatibility but is no longer used as authorization evidence.

Related to #908.

Validation

• format, cargo check, clippy, cargo-deny, library build, and library tests;
• all 32 firmware build combinations and all six standalone tool builds;
• all 14 emulation workflow scenarios;
• all five workflows triggered on the fork branch: Format and Clippy, Library Crates, Fuzzing Test, main, and Integration (Emulation Mode).

Future changes

Potential follow-up work, intentionally excluded from this focused series:

• replace raw policy-chain measurement with a stable RTMR1 trust anchor based on a root certificate and signer-purpose EKU;
• support direct trust-anchor enrollment and signer revocation through CRLs;
• support CoRIM TCB endorsements, including policies that use CoRIM without JSON servTD collateral;
• make servTD identity collateral optional where SVN-only evaluation is sufficient;
• add release tooling and coverage for independent policy, mapping, and identity signer rotation;
• strengthen two-phase measurement generation and hash-stability checks across release workflows.