fix: accept ACI wrapped PhalaDirect reports

[phala-agent]

Summary

• Accept PhalaDirect aci/1 reports where dstack evidence lives under attestation.evidence.
• Use downstream_tls_binding.spki_sha256 as the TLS SPKI channel binding.
• Validate ACI workload/keyset digests, freshness, TLS keyset membership, and quote report-data binding instead of requiring legacy app_compose / compose_hash fields.
• Add soundness coverage for genuine ACI, keyset TLS mismatch, and report-data TLS mismatch.

Test Plan

• uv run python scripts/soundness_phala_direct.py
• uv run python -m compileall scripts/provider_verifier scripts/soundness_phala_direct.py

Notes

• cargo test phala_direct_bridge_is_sound --test phala_direct_bridge was not run locally because this pod does not have cargo installed.