Revert to May-10 working state (back out #267, #269, #268)

[posix4e]

Production CP deploys have been failing since the #264–#269 cluster. The last green production deploy was b7c54fc ("Fix SSH CP deploy health verification", May 10). This backs main's src/ out to exactly that state to restore working deploys.

Reverts (newest first):

• #268 Encrypt session history end-to-end to paired device keys
• #269 Pin enclave measurement (MRTD/TCB)
• #267 Serve noise.ita_token so clients verify attestation without minting

#264/#265 are a revert-pair that already cancel, so they're left as-is. The resulting tree is identical to b7c54fc (verified: empty git diff b7c54fc HEAD). No workflow/infra files change — the deploy pipeline is the same one that was green on May 10.

These features can be re-landed individually once the CP tunnel hand-off (the 502-flap during STONITH that the brittle Verify CP health payload step trips on) is hardened.

🤖 Generated with Claude Code

[github-actions]

DD preview ready

URL: https://pr-270.devopsdefender.com

Browser login: visit https://pr-270.devopsdefender.com — DD redirects you to
the GitHub App auth broker. A DD session cookie scoped
to .devopsdefender.com lets the preview, fleet, and
shell hosts share the same login.

Machine-to-machine: GitHub Actions workflows in the
DD_OWNER org pass their per-job OIDC JWT as
Authorization: Bearer … (audience dd-agent).

Register endpoint for a local agent: https://pr-270.devopsdefender.com/register
(authenticated by ITA attestation).