refactor(contract): move TEE attestation lifecycle into api/attestation.rs

[gilcu3]

part 11/12 of #1962

[claude]

Pull request overview

This PR continues the crates/contract/src/lib.rs decomposition series (part 11/12 of #1962) by relocating the TEE attestation lifecycle — grant accounting, submit_participant_info, the dstack verify-quote promise chain and its resolve_verification callback, verify_tee, and clean_invalid_attestations — into a new api/attestation.rs module, together with the tests that cover them. Two design documents that pointed at lib.rs for these symbols were repointed at the new file.

Changes:

• New crates/contract/src/api/attestation.rs holding a #[near] impl MpcContract block with the attestation entrypoints and their private helpers, plus the moved #[cfg(test)] mod tests.
• crates/contract/src/lib.rs shrinks by the same code; top-level and test-module imports trimmed accordingly, and the tee_verifier_account_id doc link rewritten as a fully qualified intra-doc link (mpc_attestation::attestation::Attestation::Dstack) now that Attestation is no longer in scope there.
• api.rs registers the new module.
• Two docs/design/*.md path references updated.

Reviewed changes

Per-file summary

File	Description
crates/contract/src/api.rs	Registers pub mod attestation;
crates/contract/src/api/attestation.rs	New module: attestation entrypoints, grant accounting, dstack promise chain, verify_tee, cleanup, and the moved tests
crates/contract/src/lib.rs	Removes the moved code; trims now-unused imports; converts one doc link to a fully qualified path
docs/design/attestation-verifier-contract.md	Repoints submit_participant_info at api/attestation.rs
docs/design/operator-prepaid-attestation-storage.md	Repoints measure_stored_entry_bytes / measure_grant_row_bytes at api/attestation.rs

I diffed the removed lib.rs regions against the new file line by line: the move is verbatim, with no behavioral edits. Checks that came back clean:

• No duplicate or orphaned definitions remain in lib.rs; every moved symbol appears exactly once.
• All helpers the moved code reaches for (voter_or_panic, assert_caller_is_signer, assert_caller_is_attested_participant_and_protocol_active, TeeState::attestation_owner, refresh_launcher_usage) are pub(crate), and the MpcContract fields it touches are crate-root-private, so both stay visible from a descendant module.
• Import bookkeeping on both sides holds up: everything left in lib.rs is still used, and everything the new module names is used there.
• Exported WASM symbols are unaffected (a #[near] impl block generates extern "C" wrappers regardless of module), and tests/snapshots/abi__abi_has_not_changed.snap sorts functions by name, so no snapshot regeneration is needed. MpcContract itself is untouched, so the borsh schema snapshot is stable too.
• No non-permalink doc reference to the moved symbols was left behind; docs/design/attestation-verifier-contract.md:356 still correctly points clean_foreign_chain_data at lib.rs.

Findings

Non-blocking (nits, follow-ups, suggestions):

• crates/contract/src/api/attestation.rs:1200 — the [`IterableMap`] intra-doc link in the WORST_CASE_ENTRY_BYTES doc comment no longer resolves: it used to reach near_sdk::store::IterableMap through use super::* in lib.rs, and the new module does not import it. cargo make check-docs will not catch this, because rustdoc does not traverse test modules, so it rots silently. The same fix is already applied to lib.rs:89 in this PR — spell out the path rather than adding an import, since an import referenced only from a doc link trips unused_imports:

    /// [`VerifiedAttestation`] variant, including the [`IterableMap`](near_sdk::store::IterableMap) record overhead.
  

✅ Approved

[pbeza]

NGL, I rely on Claude to make sure it’s just a mechanical cut-and-paste (it compared it programmatically using some ad hoc diff-based script). The only optional thing perhaps worth addressing is the non-blocker Claude raised about the [`IterableMap`] intra-doc link in the WORST_CASE_ENTRY_BYTES doc comment no longer resolving.