feat(provider): add lease-attestation and confidential-compute deploy support

[cloud-j-luna]

Adds akt provider lease-attestation [dseq], the confidential-compute counterpart of lease-status, and makes akt deploy actually create CC workloads. Verified end to end on mainnet against a real AMD SEV-SNP + NVIDIA GPU provider: the command returns a genuine hardware attestation quote (tee_platform: snp-gpu, nonce_verified: true, mock_report: false) with the GPU attestation report and cert chain.

lease-attestation command

Resolves the lease and provider like lease-status, requests an attestation quote over a new gRPC gateway client, and reports whether the report echoes a fresh nonce, in the same JSON shape provider-services produces. This is akt's first gRPC gateway transport, beside the REST client in internal/provider, reusing akt's JWT/mTLS auth resolution.

The provider's gRPC gateway serves a self-signed certificate whose common name is the provider's on-chain address. The client verifies it against the provider's registered certificate in the cert module (standard PKI fast-path first, then on-chain), mirroring the SDK REST client rather than provider-services' InsecureSkipVerify. JWT auth matches provider-services' token exactly.

Confidential-compute deploy support

Bumps pkg.akt.dev/go/sdl v0.1.1 -> v0.4.2. The old version silently dropped params.tee, so akt deploy created plain-GPU workloads with no tee/type requirement and no attestation sidecar. With the bump, params.tee: cpu-gpu projects the tee/type placement requirement and the manifest TEE params, so the workload schedules as confidential compute (nvidia.com/pgpu) with the attestation sidecar.

Out of scope

Full cryptographic attestation of the returned quote (AMD KDS / Intel PCS endorsement chains, signature and measurement-policy verification). The command verifies nonce freshness and authenticates the transport; it does not yet validate the hardware evidence chain.

Verification

go build, go vet, go test ./..., gofmt, and golangci-lint all clean. A command-layer test drives the command end to end against an in-memory gRPC gateway; a unit test signs and verifies the attestation JWT. Confirmed live: akt deploy created a CC lease on a mainnet SEV-SNP+GPU provider, and akt provider lease-attestation returned a verified hardware quote.