[STACKED on #851] fix(simulator): replay measured NitroTPM boot PCRs

[kvinwang]

STACKED PR — merge #851 first.

Problem

The development NitroTPM simulator did not reproduce the AWS boot measurement. Its swtpm PCR4/7/12 remained zero, and the simulated NSM attestation document reported hard-coded zero PCRs. The previous version of this PR worked around that mismatch by replacing the image's real AWS measurement and os_image_hash with a synthetic all-zero identity.

That made the simulator internally consistent, but it no longer attested the image that was actually booted.

Fix

Preserve the release image's assemble-time measurement.aws.cbor and unified os_image_hash, and reproduce the corresponding AWS boot PCR state in the simulator:

• capture the ordered PCR4/7 boot-event digests emitted by the pinned AWS nitro-tpm-pcr-compute tool;
• generate measurement.aws.replay.json during image assembly;
• verify at assembly time that replaying those SHA-384 extensions produces the tool's reported PCR4/7/12;
• commit the replay artifact through sha256sum.txt and include it in image archives;
• pass the replay document to the guest simulator without replacing the real image measurement;
• replay the events into swtpm before exposing the simulated NitroTPM device;
• fail startup if live PCR4/7/12 do not equal the expected values;
• build simulated NSM attestation documents from live swtpm PCR4/7/8/12/14 instead of hard-coded zeros.

The VMM also verifies that the replay document's final PCRs produce the same boot_pcr_digest as measurement.aws.cbor.

Changed areas

• os/image: replay artifact generation, validation, packaging, and documentation
• dstack-types: typed replay document
• vmm: image loading and simulator-only transport while preserving the real image identity
• tee-simulator: PCR replay and live-PCR NSM evidence
• tpm2: stream transport support for the simulator's swtpm socket

Dependency and merge order

• Parent PR: fix(vmm): pass cloud image measurements to guests #851
• GitHub base branch: codex/fix-vmm-cloud-image-measurements
• Merge the parent first.

Verification

• cargo check -p dstack-types -p dstack-vmm -p dstack-tee-simulator
• cargo test -p dstack-vmm -p dstack-types -p dstack-tee-simulator --no-run
• focused VMM simulator-config transport test
• synthetic replay-generator test, including final-PCR verification
• cargo fmt --all
• git diff --check

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.