feat(tee-cli): harvest a founding cohort's summit keys into inputs/

[samlaf]

D1 of the founding reorder: boxes now boot identity-free with summit-key-holder (enclave #232) serving {pubkeys, quote} on :7879 until the config POST. network harvest is the new step between up --network and manifest assemble — it collects each box's summit pubkeys with a TDX quote over a fresh per-box nonce, DCAP-verifies them against the intended image measurements, and archives the result as the provenance assemble (D2) will pin the founding validator set from.

What it does

• Polls every box's holder round-robin (15 min budget); mints a fresh 32-byte nonce per box, so report_data = founding_summit_keys_binding(nonce, node_pk, bls_pk) can't be satisfied by a quote replayed from an earlier harvest.
• Verifies each quote by shelling out to the enclave repo's verify-quote (#231; exit 0 + one JSON report on stdout <=> verified), against the policy promoted from inputs/measurements.json by the same admission CLI assemble uses. Evidence goes over stdin — the same parsed object the archive records.
• Archives {harvest_nonce, node_public_key, consensus_public_key, evidence, harvested_at, verification} to inputs/harvest/<node>.json and pairs the cohort exact-both-ways against the authored inputs/founder-withdrawal-credentials.json (node name -> withdrawal credentials; retires nothing yet — the ceremony's _ANVIL_ADDRESSES goes with D3).

Burned-key rule, in code where detectable

HTTP 410 (quote window closed — the box already took a config POST), any other 4xx, a failed verification, and duplicate pubkeys across boxes all abort the whole harvest with a re-found message; transport errors and 5xx are the normal boot tail and get polled. Existing harvest files refuse overwrite without --force. Holder pubkeys are accepted only in summit's keystore spelling (bare lowercase hex) so nothing else is laundered into the archive.

Verification here is preventive, not a fact to be trusted: the evidence and the nonce it binds are archived so future users can re-run verify-quote and reach their own verdict. TODO: snapshot the DCAP collateral under inputs/harvest/dcap-collateral/ once the capture mechanism is resolved — until then re-verification depends on Intel's live collateral.

Tests are offline (holder fetch and verifier subprocess mocked). An end-to-end run needs the images-side holder unit (I1).