Attest the box in oprf-mode boot gate and provisioning

[kwsantiago]

The mode = "oprf" units called keep frost network oprf-provision / oprf-unlock without --tpm-tcti, so the box attached no attestation quote to its requests. Holders gate enrollment and evaluation on a VERIFIED dealer (and refuse NotConfigured), so an unattested box is rejected: provisioning never seals a share and the boot-time unlock fails closed. The end-to-end OPRF test (#10) surfaced the same requirement at the CLI level.

Changes

• New keepNode.frostGate.tpmTcti option (default device:/dev/tpmrm0): the box's TPM TCTI, used to attach a measured-boot quote so holders can verify this dealer.
• Wire --tpm-tcti ${cfg.tpmTcti} into both the boot-time oprf-unlock and the operator-driven oprf-provision calls.
• Runbook note on keep-node-frost-provision: the box attests during provisioning and every boot unlock, which needs the tpm-attestation keep-cli build feature and TPM device access (e.g. /dev/tpmrm0) on both this unit and the boot gate. Neither unit sandboxes devices, so a default root oneshot already has access; if device sandboxing is added later, allow the TPM (DeviceAllow=/dev/tpmrm0 rw).

The module's oprf-mode path still has no nixosTest of its own (tracked separately); this change is validated by nix eval + formatting and the existing tpm-mode frost-gate test (unaffected).