Tooling: extract nitro.pcrs from the pinned tkhq/qos rev

[prasanna-anchorage]

Context

VisualSign self-hosted TEE deployments run inside an AWS Nitro Enclave whose runtime is provided by tkhq/qos. The qos git rev is pinned across ~8 qos_* workspace dependencies in src/Cargo.toml. To verify attestations from a deployment, wallet integrators need the PCR values (PCR0/PCR1/PCR2) of the corresponding qos enclave image.

Today, reproducing those PCR values is a manual sequence: read the rev out of Cargo.toml, clone qos, check out the rev, run make out/qos_enclave/index.json, then extract /nitro.pcrs from the resulting OCI image via skopeo + docker. The docs/wallet-integration/self-hosted-tee/getting-started.mdx page acknowledges this gap with a <Note> reading "Detailed instructions are coming soon."

Proposed change

Add a small bash tool at scripts/extract-nitro-pcrs.sh that automates the sequence:

1. Read the qos rev from src/Cargo.toml (asserting all qos_* deps agree).
2. Clone tkhq/qos at that rev into an ephemeral mktemp -d (overridable via --qos-dir).
3. Run make out/qos_enclave/index.json inside the qos checkout.
4. Convert the OCI directory to a docker-archive tar by running quay.io/skopeo/stable in a container — no host skopeo install needed.
5. docker load + docker cp /nitro.pcrs to the configured output path.
6. Print the PCR lines to stdout and clean up via trap.

Also expand the self-hosted-tee getting-started doc with usage, options, a how-it-works walkthrough, and a reproducibility check, and update the attestation page's "Updating your allowlist" section to point at the new tool.

Acceptance criteria

• scripts/extract-nitro-pcrs.sh exists, is chmod +x, and shellcheck-clean.
• Default invocation produces out/nitro.pcrs containing PCR0/PCR1/PCR2 hex lines.
• Two consecutive runs produce byte-identical output (reproducibility).
• PCR values match what qos's own build pipeline produces for the pinned rev (cross-check: PCR2 matches qos README example for the pinned rev).
• docs/wallet-integration/self-hosted-tee/getting-started.mdx documents the tool.
• docs/wallet-integration/self-hosted-tee/attestation.mdx links to the new doc section from its allowlist-update flow.

Out of scope

• Wiring the script into CI (a separate change can add a job that runs it and asserts the expected hashes).
• Measuring parser_app itself — these PCRs cover the qos enclave runtime only; parser_app is loaded into qos at runtime and is integrity-checked via the qos manifest (Level 3 attestation).
• Building parser_app into a custom EIF — VisualSign uses qos's loading model, not a bespoke EIF.