refactor(guest-agent): restrict GetQuote to Intel TDX

[kvinwang]

Problem

GetQuote answered on every platform, but only on Intel TDX did it return what its
name promises. Elsewhere — AMD SEV-SNP, AWS Nitro, and friends — it returned an empty
quote and an empty event_log, and put the real evidence in a fifth field,
GetQuoteResponse.attestation, holding a SCALE/msgpack versioned attestation:

message GetQuoteResponse {
  // TDX quote (empty on non-TDX platforms such as AMD SEV-SNP)
  bytes quote = 1;
  ...
  // Platform-adaptive versioned attestation (SCALE/msgpack encoded). Populated
  // on non-TDX platforms; TDX uses quote + event_log above.
  bytes attestation = 5;
}

So a client had to test whether quote was empty to learn which field carried the
answer, and one response type had two mutually exclusive shapes. Attest already
returns exactly that versioned attestation, on every platform, in one shape — the
attestation field was a second, shape-shifting way to ask the same question.

The silent-failure case is worse. Tappd.TdxQuote and RawQuote share this backend
path and copy only quote and event_log into their own response, dropping field 5.
On a non-TDX platform they returned quote: "" with no error — a caller asking for
attestation evidence got an empty string back and nothing to indicate why.

Fix

GetQuote is now Intel TDX only; every other platform gets an error naming Attest
as the replacement. Field 5 is removed and reserved. Tappd.TdxQuote/RawQuote and
Worker.GetAttestationForAppKey share the backend path, so they fail closed there too
instead of returning an empty quote. GCP TDX is unaffected — it carries a real TDX quote.

Four commits, ordered so no commit leaves a regression behind:

1. fix(gateway): keep the attestation when the quote request fails — stands on its
   own. distributed_certbot.rs treated a get_quote failure as fatal (return Ok(()))
   while tolerating an attest() failure, so a transient QGS outage threw away the
   attestation it could still have had, and saved no record at all. Both are best-effort
   now, and the save is skipped only when both come back empty. Without this, commit 2
   would have silently stopped non-TDX gateways from persisting ACME and cert
   attestations entirely.
2. refactor(guest-agent): restrict GetQuote to Intel TDX — the RPC change.
3. refactor(sdk): drop the GetQuote attestation field — Rust, Python, Go, JS.
4. docs: mark GetQuote as Intel TDX only

Wire compatibility

Field 5 never shipped. It is absent from v0.5.7, v0.5.8 and v0.5.9
(git show v0.5.9:dstack/guest-agent/rpc/proto/agent_rpc.proto), so no released client
can be reading it. It is reserved anyway, following vmm_rpc.proto.

Verification

• cargo clippy --workspace --all-features -- -D warnings --allow unused_variables clean
  on this branch; cargo fmt --all --check clean.
• cargo test -p dstack-guest-agent -p dstack-guest-agent-simulator -p dstack-gateway --all-features passes.
• New regression test simulator_rejects_get_quote_on_non_tdx pins both halves of the
  contract on one attestation: it swaps the TDX fixture's platform evidence for
  PlatformEvidence::SevSnp, asserts simulated_quote_response fails with an error
  containing "Intel TDX only", then asserts simulated_attest_response still succeeds.
• SDKs: go build ./... and go vet ./dstack/ clean; tsc --noEmit clean;
  cargo check --all-features and cargo fmt --check clean in sdk/rust.
• Grepped the tree for readers of the removed field — the only remaining .attestation
  hits are on AttestResponse and GpuInfoResponse, which are untouched.

Follow-up (not in this PR)

ct_monitor declares its own QuotedPublicKey with just public_key and quote, and
sends only quote/event_log/vm_config to the verifier — it never reads the
attestation field the gateway publishes, even though /verify accepts it. That CT
monitoring path has therefore never worked on non-TDX, before or after this change.
This PR makes sure the evidence is at least stored and served; teaching ct_monitor
to consume it is separate work.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.