feat(L1): validate hinted Nitro attestations

[leopoldjoy]

Summary

• replace the Registry legacy NitroEnclaveVerifier immutable and two-argument ZK registration API with INitroValidator and registerSigner(bytes,bytes,bytes)
• enforce Base freshness, 48-byte non-debug PCR0, and 65-byte uncompressed secp256k1 public-key policy after hinted validation
• preserve proxy storage, signer/proposer behavior, TEEVerifier behavior, and the legacy verifier deployment for rollback
• validate predeployed Registry immutables before ProxyAdmin upgrades

Deployment

• add nitroValidator to deploy config, SystemDeploy inputs/outputs, artifacts, and development scripts
• SystemDeploy.upgrade accepts a predeployed TEEProverRegistry implementation, validates its validator and factory immutables, and upgrades the existing proxy
• the legacy NitroEnclaveVerifier proofSubmitter is deliberately left unchanged; existing deployments remain rollback-ready and fresh deployments must prepare it before a legacy rollback
• checked-in nitroValidator config values remain zero until the C2 stack is deployed for each environment; populate the address before a multiproof deployment or upgrade

Testing

• real AWS-signed hinted attestation through P384Verifier, CertManager, NitroValidator, and the Registry wrapper
• mocked dependency-revert propagation plus real-validator integration and gas coverage
• owner/manager authorization, freshness boundaries, PCR0/debug policy, key format and signer derivation
• standard ProxyAdmin upgrade from a 0.5.0 Registry with owner, manager, game type, proposers, signer set, and image hash preserved
• invalid embedded-validator rejection for prebuilt Registry upgrades
• full suite: 1,286 passed, 0 failed, 1 skipped
• just snapshots and just semver-lock
• source size check: TEEProverRegistry runtime 8,298 bytes

Stack

• chore(L1): pin hinted nitro validator #394 and feat(L1): deploy hinted nitro validator stack #395 are merged
• targets main

[linear]

CHAIN-4838

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1