Add threshold-OPRF unlock nixosTest

[kwsantiago]

Adds an end-to-end NixOS VM test for the threshold-OPRF vault unlock: a relay, a box (with swtpm), and one OPRF holder, each a real NixOS node running the real keep CLI. No hardware required.

The test exercises the full quorum path:

1. FROST group setup (box deals share 2 to the holder)
2. Attestation bootstrap (box announces a TPM quote, holder pins it TOFU)
3. Holder serves as an OPRF holder (receives its sealed share, then answers evaluations, gated on attestation)
4. Box provisions the OPRF quorum
5. Box requests a 2-of-3 unlock and reconstructs the same 32-byte LUKS key

The third holder (replica) is absent, so a single share never reaches quorum: box + one holder = threshold 2. Attestation is real (swtpm quotes); the VM's PCRs are boot-reset values (no measured boot), so this exercises the produce/verify/gate path, not a meaningful measured-boot policy (that is the Lanzaboote work).

Also bumps the keep input to pick up the --tpm-tcti wiring on oprf-provision/oprf-unlock/serve that the box needs to produce its quote during provisioning and policy bootstrap.

Run: nix build .#checks.x86_64-linux.oprf-unlock