refactor: migrate verifier client to pontifex

[Takaros999]

PR 3 of 3.

This PR updated the verifier client with the latest API changes and adopts pontifex. It also deletes attested-channel 🪓 .

---

Note

High Risk
This replaces local attestation and sealed-channel cryptography with an external library and tightens PCR policy, which can break assignments or wire compatibility if Pontifex behavior diverges from the removed crate.

Overview
Removes the in-repo attested-channel crate (Nitro attestation verification and the HPKE match channel) and routes the verifier client and e2e harness through Pontifex for attestation and sealed channels. Workspace/release config drops the published attested-channel package and related crypto workspace dependencies.

The verifier client now builds a Pontifex Verifier from config, verifies assignments via ChannelConsumer::from_attestation using MATCH_CHANNEL_DOMAIN plus separate base64 attestation and public_key fields, and seals/opens match traffic with seal_to_enclave / open_from_enclave. request_assignment and request_match no longer take a clock argument; VerifiedAssignment exposes attestation() and consumer() instead of a public Requester.

Configuration is tighter and Pontifex-shaped: PCR policies must include a nonzero 48-byte PCR0, measurements are 48 bytes with unique indices, allow_debug_measurements is removed, Config::verifier() can fail, and JSON uses deny_unknown_fields with hex PCR serde. Public re-exports shift to Pontifex’s ChannelConsumer and PcrMeasurement.

E2e defaults to the full HTTP client path; optional VERIFIER_E2E_TRANSPORT=vsock keeps a Pontifex vsock match path using the same verified assignment consumer. Client tests were updated for the new APIs and slimmer assignment fixtures.

^{Reviewed by Cursor Bugbot for commit 1be45df. Bugbot is set up for automated code reviews on this repo. Configure here.}

[paolodamico]

@codex review

[paolodamico]

cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 1be45df. Configure here.}