fix: resolve clippy warnings (collapsible_if, too_many_arguments) (#46)

feat: bind model identity to transcript hash (v2) (#45)

fix: correct SEV-SNP report layout offsets per AMD ABI spec (#43)

feat: wire VCEK cert through attestation pipeline (Wave 2) (#42)

feat: VCEK signature chain verification (Wave 1) (#41)

Merge pull request #38 from vcav-io/codex/contract-model-profile-hash

feat: reject contract-bound model profile hashes

Merge pull request #37 from vcav-io/codex/failure-receipt-transcript-binding

fix: bind tee failure receipts to emitted transcript fields

Merge pull request #36 from vcav-io/codex/tee-contract-fail-closed

Merge pull request #35 from vcav-io/codex/tee-capability-tokens

fix: reject unsupported contract semantics in tee relay

chore: update lockfile for tee relay hardening

fix: harden tee relay token handling

fix: gate tee relay sessions with capability tokens