vaportpm: split session out of derive; build in lockboot:build; drop rcgen/ring

[HarryR]

Three related changes, stacked on #9 (this is one unit of work).

1. attest: split session/policy out of derive. Extract the generic TPM
auth-session + policy commands (start_auth_session, policy_pcr,
policy_get_digest) from derive.rs into a new session.rs as a pub(crate) SessionOps trait, and dedupe the single-bank PCR-selection helper into pcr.rs.
derive.rs keeps only the PCR-gated key-derivation feature. Public API unchanged.

2. build: run cargo inside lockboot:build. Adopt the stage0/stage1 shape --
a vendored build.mk (canonical copy in stage0, synced via the workspace
make sync-harness) wraps every cargo target in DOCKER_RUN -> lockboot:build,
so vaportpm builds cc-free-by-design and reproducibly. Host links with the image
cc (rust-lld cannot link glibc executables); musl release artifacts use rust-lld

• crt-static. Adds Dockerfile.build, rust-toolchain.toml (1.91.1) and
  .cargo/config.toml; CI now runs make ci in-image on the pinned toolchain; drops
  the standalone rust:latest devcontainer in favour of the workspace one.

3. verify: drop rcgen/ring from tests. Replace the rcgen dev-dependency (which
pulled ring + a C toolchain) with x509-cert's builder + p256/p384 signers for
the test certificate factory. Removes ring, cc, rcgen, yasna, untrusted,
time from the resolved graph; nothing new pulled but the builder/hazmat features
(opted in by verify only, so attest's no_std/UEFI build is unaffected) and a
rand_core dev-dep.

make ci is green in lockboot:build (fmt-check + check + clippy -D warnings + test

• doc; gcp 16 + nitro 13 integration tests + lib tests pass).

Note: the shared build harness also lands in stage0/stage1 (their build.mk +
Makefile include) and the workspace (sync-harness/check-harness) via their own
branches -- this PR carries only vaportpm's slice.

🤖 Generated with Claude Code