libre: attested-peering trust plugin

Description

The pitch.

# [Hackathon] libre: attested-peering trust plugin

**Persona:** `libre` — a self-sovereignty / decentralized-infrastructure engineer
(maintainer of LibreSynergy, a self-hostable community mesh). This persona cares
about *who you are federating with* before any data crosses the wire: friend or
foe, hardware you can trust, an operator who stands behind the agent.

## Motivation

The two bundled trust plugins answer *"how well has this agent behaved?"*
(`score_average` averages feedback; `agent_receipts` corroborates it with
receipts). Neither answers the **prior** question: *is the thing reporting
feedback even who it claims to be, and should its evidence count at all?* Under
the default `score_average` plugin any agent — including a freshly minted Sybil —
can file unlimited `report()` calls and poison a victim's reputation.

This PR adds an **`AttestedPeering` trust layer** that gates evidence admission
behind a mutual, replay-proof **identity + hardware-root attestation** handshake.
It is a **novel composition of two layers** — Identity gating Trust — ported from
LibreSynergy's production mesh-federation gate.

## Design

A three-question handshake (`hail` → `vouch` → `seal`), each question a distinct
attestation:

1. **Friend or foe?** — the peer proves possession of the private key for the
   identity it presents by signing *this session's transcript* (never a
   replayable bare nonce), and its `AgentFactsCard` must be authentic
   (self-signature + operator delegation valid).
2. **Can I trust you with my data?** — an optional, nonce-bound signed
   environment quote over the peer's measured configuration (a deterministic
   stand-in for a TPM measured-boot quote).
3. **Who do you work for?** — a named operator must have delegated authority to
   the agent via a signed delegation in its passport, and that operator must be
   on the verifier's trusted-operator roster.

Only peers whose verdict is `ALLOW` may contribute evidence via `report()`;
everything else is quarantined and surfaced in the trace.

### Tradeoffs

- **Ed25519 over openssl subprocess.** LibreSynergy's original uses an `openssl`
  subprocess; that violates the Tier-1 determinism rule (no `subprocess`, no
  `os.urandom`, no wall-clock). Ported to in-process `cryptography`: seeds are
  `sha256(seed || agent_id)[:32]` (matching `identity.ed25519_rotating`) and
  nonces come from a per-instance seeded `random.Random`. Ed25519 itself is
  deterministic by construction (RFC 8032), and the module reads no clock at
  all, so a Tier-1 run is byte-identical under a fixed seed (asserted by
  `test_scenario_is_byte_deterministic`).
- **Transcript-bound proof, not bare-nonce.** Signing the session transcript
  closes the replay window a bare-nonce challenge leaves open.
- **Attestation #2 is optional** so the plugin degrades gracefully to identity-
  only gating where no measured quote is available.

## API fit

- Implements the `Trust` layer Protocol; registered under
  `[project.entry-points."nest.plugins.trust"]` as `attested_peering`.
- `from __future__ import annotations`, SPDX header, docstrings with `Example::`
  blocks on public classes and methods.
- Ships a scenario (`scenarios/attested_peering.yaml`) and a built-in scenario
  module — slots into the runner with no core edits beyond one registration line
  and the scenario table.

## How to verify

```
uv sync
uv run pytest packages/nest-plugins-reference/tests/test_attested_peering.py \
              packages/nest-core/tests/test_validators.py -q   # 145 passed
uv run nest run scenarios/attested_peering.yaml                 # ALLOW/quarantine trace
make ci-local                                                  # full gate: ruff + format + pyright + 823 pass
```

## Tests (145 passing)

Adversarial by construction — the suite exercises the failure modes the feature
introduces, not just the happy path:

- **Stolen passport, wrong key** → rejected (key-possession proof fails).
- **Replayed proof from another sess

…