feat: --mock-prove flag in saya-tee + saya-ops mock TEE registry deploy

[kariy]

Summary

Adds a --mock-prove flag to saya-tee tee start plus a paired
saya-ops core-contract declare-and-deploy-tee-registry-mock
subcommand. Together they let end-to-end tests exercise Piltover's
TEE settlement path without producing or verifying real AMD SEV-SNP
attestations or burning SP1 prover network credits.

This is the off-chain half of the e2e mock plumbing. The on-chain
half is the new piltover_mock_amd_tee_registry contract in
cartridge-gg/piltover#15.

What --mock-prove does

When set, saya-tee skips the entire pipeline that:

• parses the AMD SEV-SNP attestation report (AttestationReport::from_bytes)
• fetches AMD KDS certs over HTTPS (KDS::fetch_report_cert_chain)
• validates the cert chain against AMD's root CA (CertChain::check_valid)
• looks up trusted certs in the on-chain registry (StarknetRegistryClient::fetch_trusted_prefix_len)
• submits to the SP1 prover network (AmdSevSnpProver::prove)

Instead, it computes the same Poseidon commitment that Piltover's
validate_input would otherwise extract from a real attestation:

Poseidon(prev_state_root, state_root, prev_block_hash, block_hash,
         prev_block_number, block_number, messages_commitment)

…and stuffs it into a 296-word stub raw_report whose report_data
field is laid out so that Piltover's existing u128_byte_reverse-based
reconstruction yields the original commitment. The stub
VerifierJournal is Cairo-Serde-serialized, the felts are stored in
TeeProof.data as raw big-endian bytes, and
TeePiltoverSettlementBackend forwards them directly to
TEEInput.sp1_proof (skipping OnchainProof::decode_json and
StarknetCalldata::from_proof).

Why both pieces in one PR

The --mock-prove flag is useless without a permissive
IAMDTeeRegistry deployed at the --tee-registry-address slot, and
the new saya-ops subcommand is the deploy mechanism. Bundling them
keeps the e2e wiring atomic.

The saya-ops subcommand mirrors the existing
declare-and-deploy-fact-registry-mock exactly (same path/salt env
vars, same UDC deploy, same info! log line). It embeds a vendored
Sierra artifact at contracts/tee_registry_mock.json built from
cartridge-gg/piltover#15's
piltover_mock_amd_tee_registry contract.

Safety

--mock-prove is gated behind an explicit flag that defaults to
false. The CLI help, the field doc on Start, the module-level
docs in mock_proof.rs, and the runtime log line all clearly mark it
as test-only. The real proving path is unchanged in non-mock mode.

Test plan

• cargo build clean across bin/persistent-tee and bin/ops.
• cargo test passes (5 new unit tests in mock_proof cover the
  felt round-trip, raw_report layout, report_data byte ordering vs
  Piltover's u128_byte_reverse reconstruction, and serialized
  journal length).
• saya-tee tee start --help shows --mock-prove with full
  documentation.
• saya-ops core-contract --help shows
  declare-and-deploy-tee-registry-mock.
• End-to-end test in dojoengine/katana exercising both flags
  against the piltover branch and a katana node with TEE-mode RPC.
  This is the next PR.

Companion PRs

• feat(input): add mock_amd_tee_registry for e2e tests cartridge-gg/piltover#15: mock_amd_tee_registry Cairo contract.
• dojoengine/katana (TBD): tests/saya-tee e2e test crate that
  spawns Katana + saya-ops + saya-tee with all of these.

Maintaining the embedded mock TEE registry artifact

The contracts/tee_registry_mock.json file embedded into saya-ops
via include_bytes! is the compiled Sierra class of the
piltover_mock_amd_tee_registry Cairo contract from
cartridge-gg/piltover#15.
It is not built or maintained from source in this repo — saya
only carries the pre-built artifact, mirroring how the existing
fact_registry_mock.json is handled.

If the Cairo source ever changes (e.g. the IAMDTeeRegistry
interface gains a field, or the mock's pass-through behavior is
adjusted), the artifact must be manually rebuilt and re-vendored:

# 1. Build the Cairo contract from the piltover branch
cd /path/to/cartridge-gg/piltover
git checkout feat/tee-mock-registry  # or whichever branch hosts the source
scarb build

# 2. Copy the compiled Sierra class into saya
cp target/dev/piltover_mock_amd_tee_registry.contract_class.json \
   /path/to/dojoengine/saya/contracts/tee_registry_mock.json

# 3. Rebuild saya-ops to pick up the new bytes
cd /path/to/dojoengine/saya
cargo build --bin saya-ops

The setup-program flow does not need any changes when the mock
registry's class hash changes — saya-ops's
declare-and-deploy-tee-registry-mock declares the (potentially new)
class on the fly each time.

[kariy]

Status update — piltover companion merged ✅

cartridge-gg/piltover#15 has been merged into feat/tee-persistent (commit 37e487f7). The vendored contracts/tee_registry_mock.json in this PR was rebuilt from the merged base and is byte-identical to the artifact already committed, so no re-vendoring is required.

Doc comments and PR description references to the now-stale feat/tee-mock-registry source branch have been replaced with generic piltover#15 references in commit dbf4446.

This PR is now ready for review on its own merits. The only remaining cross-repo dependency is the downstream Katana e2e PR that consumes the new --mock-prove flag and declare-and-deploy-tee-registry-mock subcommand.