feat: share hardware placement validation

[intel352]

Summary

• add public hardware placement capability structs to compute-core
• add helpers for required hardware class derivation and verified attestation placement satisfaction
• cover confidential CPU/GPU and custom hardware class placement behavior

Verification

• RED: GOWORK=off go test ./protocol -run 'TestHardwareCapabilitiesSatisfyPlacementRequirements|TestRequiredHardwareClass' -count=1 failed with undefined helper/types before implementation
• GREEN: GOWORK=off go test ./protocol -run 'TestHardwareCapabilitiesSatisfyPlacementRequirements|TestRequiredHardwareClass' -count=1
• Regression proof: with protocol/types.go implementation reverted, the focused tests failed with undefined helper/types; restored implementation passed
• GOWORK=off go test ./... -count=1
• git diff --check

Adversarial review

• Fixed date-sensitive positive attestation tests by injecting explicit Now.
• Kept trust-root, signature verification, and attestation bundle ingestion out of compute-core for this slice.
• Helper accepts placement/capability data only, so workflow-compute can delete local placement fallback logic in the consumer PR.