fix(tpm): classify signature envelopes by key shape

[noah-ing]

What

Classify legacy bare TPM quote signatures from the attestation key's signature shape instead of the untrusted sigAlg prefix:

• RSA byte input exactly one modulus wide remains in the documented bare PKCS#1 v1.5 lane.
• EC byte input must decode as a complete DER ECDSA signature to remain in the legacy lane.
• All other byte input is parsed strictly as a marshalled TPMT_SIGNATURE.

The regression coverage includes the committed reference vectors, supported and unsupported two-byte envelope mutations, malformed EC framing, and a fixed public synthetic vector whose valid 2048-bit bare RSA signature begins with 0x0014.

Why

This is a narrow follow-up to the typed signature work in #320 and the reference vectors in #323.

The current discriminator treats a byte string as TPMT_SIGNATURE only when its first two bytes name a supported scheme. As a result:

1. Changing only a real envelope's sigAlg to an unsupported value moves it into the legacy bare-signature path, changing an explicit unsupported-algorithm error into a generic False result.
2. A valid modulus-sized bare RSA signature whose cryptographic bytes happen to begin with 0x0014, 0x0016, or 0x0018 is misclassified as an envelope and rejected.

The patch makes framing depend on the AK representation, not attacker-controlled envelope metadata. Invalid mutated evidence remains rejected; its diagnostic becomes explicit. Documented legacy bare RSA inputs with scheme-like random prefixes can now verify normally.

The fixed compatibility vector is synthetic public test cryptography. It did not come from a TPM and establishes no hardware provenance.

Spec impact

None. This is an SDK-only parsing and legacy-compatibility correction; no normative text or conformance IDs change.

Test plan

• pytest -v equivalent full suite passes: 1,340 passed, 6 skipped, 1 xfailed
• mypy src/agent_manifest passes: 26 source files
• ruff check src/ tests/ --select E,F,W --ignore E501 passes
• New and updated tests cover the change: 78 focused TPM tests pass
• Spec changelog requirement is not applicable; the Unreleased SDK changelog is updated

Additional verification:

• bandit -r src/agent_manifest -c pyproject.toml — 0 findings
• pip-audit — no known vulnerabilities
• fresh wheel and sdist build — passed
• Twine 7.0.0 metadata checks — both distributions passed
• isolated install/API/CLI smoke from both wheel and sdist — passed
• detect-secrets 1.5.0 on changed files — 0 findings
• fixture hashes and direct PKCS#1 v1.5/SHA-256 verification — passed
• git diff --check and git fsck --full — passed

DCO

All commits in this PR are signed off (git commit -s). By submitting this PR I certify the Developer Certificate of Origin.

[github-actions]

🟡 Contributor Check: MEDIUM

Check	Result
Profile	MEDIUM
Credential	LOW
Overall	MEDIUM

Automated check by AgenTrust Contributor Check.