fix(vmm): generate simulated SEV-SNP mr_config

[kvinwang]

Problem

A simulated SEV-SNP launch has manifest.no_tee = true because QEMU is not launching a hardware-protected VM. The previous MR-config policy treated no_tee as sufficient to suppress all MR configuration, so the VMM did not create the V3 document that the SEV-SNP simulator needs to derive and verify HOST_DATA.

The original fix expressed the exception as an opaque boolean. That hid the broader policy: TDX may select no MR config, V1, or V3, while real and simulated SEV-SNP require V3.

Fix

Centralize MR-config policy and document preparation in app/mr_config.rs:

mr_config_version(...) -> Result<Option<MrConfigVersion>>
VmWorkDir::prepare_mr_config(...) -> Result<Option<String>>

The resulting policy is:

• simulated SEV-SNP: V3, even though the underlying launch has no_tee = true
• real SEV-SNP: V3
• TDX with use_mrconfigid = false: no MR config
• TDX with MRCONFIGID enabled and no key-provider ID: V1
• TDX with MRCONFIGID enabled and a key-provider ID: V3
• ordinary no-TEE launch: no MR config

A TDX deployment with a key-provider ID requires V3. If MRCONFIGID is disabled, mr_config_version() now rejects the invalid combination before document generation instead of silently launching without the required identity binding.

Both normal and one-shot launches call the same preparation method. Version selection, validation, GPU-policy binding, and V3 document construction therefore cannot drift between the two paths.

V2 remains a compatibility fallback in tdx_mr_config_id() for an older work directory that has a key-provider ID but no V3 document; it is not selected for a newly prepared launch.

Why simulated SNP needs V3

SEV-SNP carries only the 32-byte HOST_DATA field in its attestation report. dstack binds the complete app identity by hashing the canonical V3 document into HOST_DATA; the guest then validates the supplied document against that report value. The simulator must receive the same document as a real SNP launch.

This is independent of TDX lite. TDX lite controls OS-image measurement verification and does not itself require V3.

Verification

• Full dstack-vmm test suite: 57 passed
• dstack-vmm all-targets check: passed
• Strict dstack-vmm Clippy: passed
• Test merge with current origin/master: clean
• Version-selection test on the test merge: passed
• git diff --check: passed

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.