NOISSUE: Add attestation-test wasm component example using elastic:hal

[JeffMboya]

What type of PR is this?

Feature: adds an attestation-test WASM component example using the elastic:hal/attestation@0.1.0 interface from wasmhal.

What does this do?

Adds examples/attestation-test — a wasm32-wasip2 component that calls elastic:hal/attestation to generate a TEE attestation report. The component exports elastic:hal/run and is built with wit-bindgen against a minimal local WIT file (attestation interface + world only).

Which issue(s) does this PR fix/relate to?

N/A

Have you included tests for your changes?

Tested on an Intel TDX CVM (kernel 6.11.0-17-generic, /dev/tdx_guest present) using hal-runtime built from wasmhal @ cfe99ef. Component loads, WIT interface resolves, and attestation call returns successfully (exit 0).

Did you document any new/modified features?

N/A

Notes

WIT sourced from wasmhal @ cfe99ef. The local hal.wit is intentionally minimal — only the attestation interface and hal-consumer world, since wit_bindgen::generate! requires a local path at compile time.

[JeffMboya]

TDX test results (ran on uv-intel, commit 7ff9ad4)

Tested inside a real Intel TDX CVM (kernel 6.11.0-17-generic, /dev/tdx_guest present) using hal-runtime built from wasmhal @ cfe99ef:

• Component loads and runs — exit 0
• WIT interface (elastic:hal/attestation@0.1.0) resolves correctly against hal-runtime
• TDX detected correctly by the HAL: Intel CPU ✓, /dev/tdx_guest ✓, TSM support ✓, TDX CPU flag ✓
• report_data (32 × 0x42) passed through correctly

One note: the attestation response still returns a placeholder (platform: amd-sev-snp, measurements: placeholder_hash). The HAL detects TDX correctly but falls through to its simulated path rather than issuing TDXGUEST_GET_REPORT0 via /dev/tdx_guest. That is a gap in wasmhal @ cfe99ef, not in this PR.

[JeffMboya]

Updated: Rewritten as WASI P1 core module

Following reviewer feedback, the example has been refactored from a WASI P2 component model approach to a WASI P1 core module, matching the pattern used by hal-test. All proplet changes have been removed — the PR now only adds examples/attestation-test.

What changed

• Replaced src/lib.rs (wit-bindgen component) with src/main.rs using raw extern "C" imports against the elastic:tee-hal/* namespace
• Removed wit-bindgen dependency and local WIT files
• Target is now wasm32-wasip1 (via .cargo/config.toml)
• Routes through the existing hal_linker.rs path in proplet — no proplet changes needed

Verified on Intel TDX CVM

Ran the new WASI P1 binary (attestation-test.wasm, 54KB) on the TDX CVM (kernel 6.11.0-17-generic, /dev/tdx_guest present):

platform-info: {"platform_type":"IntelTdx","version":"0.1.0","attestation_support":true}
attestation: ok (evidence len=863)
evidence: {"measurements":{"mrtd":"69485508...","rtmr0":"ae6a79a0...","rtmr1":"fc7cecbe...","rtmr2":"35713c45...","rtmr3":"94a170d5..."},"platform":"intel-tdx","tdx_module_version":"1.5.0","version":"0.1.0"}

Real TDX measurements returned. The WASI P1 module dispatches correctly through start_app_core → hal_linker.rs → HalProvider::platform.attestation().