feat: share attested proof binding validation

[intel352]

Summary

• add compute-core verifier result, attestation decision, key-release decision, and signature envelope protocol structs
• add AttestationDecision.BindingDigest and ValidateAttestedProofBinding for reusable attested proof receipt binding checks
• cover missing/mismatched evidence, confidential GPU evidence, executor proof metadata, and time-window failures

Verification

• GOWORK=off go test ./protocol -run 'TestValidateAttestedProofBinding|TestAttestationDecisionBindingDigest' -count=1
• GOWORK=off go test ./... -count=1
• GOWORK=off go build ./...
• GOWORK=off go vet ./...
• GOWORK=off go test ./... -race -count=1
• wfctl plugin validate-contract .
• git diff --check