fix(verify/sev_snp,tpm): enforce canonical lowercase hex in measurement checks and validate report_data_hex (#811) - #816

Reviewed exact head 87498ac against #811. Independent synthetic SNP/TPM controls reproduce the previous acceptance of an overlong report_data_hex and the previous misclassification of noncanonical measurement hex; this head rejects them while preserving a valid lowercase measurement and 128-character report-data control. The focused checks passed (50 passed, 1 skipped), as did the broader unit, conformance, integration, and confinement suite (2,640 passed, 43 skipped), lint, typing, and dependency checks.

I approve this fix within that local verification scope. The synthetic SNP control did not include a VCEK certificate chain, so this review does not claim hardware attestation. Normal hosted checks and maintainer approval remain applicable.

Reviewed exact head 87498ac6853e59e43ebd7cc5d5b9a3f078dbd2e9 in an isolated checkout.

The SNP/TPM measurement guards require the declared lowercase digest formats, and report-data input is validated before decoding rather than silently truncating oversized values. The focused format/report-data regression passes here and fails with the actual baseline verifier modules restored in process. Valid report/measurement controls remain passing; this review does not establish new hardware execution.

Independent validation in a fresh repository-hash-locked Python 3.12.10 environment: 2,526 tests passed, 20 skipped; pip check, configured Ruff, mypy, Bandit and diff whitespace checks passed. Commit sign-offs are present. Hosted CI and applicable independent maintainer/security gates remain separate prerequisites to merge.

Reviewed with OpenAI Codex.