docs(spec): correct implementation status that drifted behind the code

[imran-siddique]

Stacked on #61 (base is fix/tdx-nested-qe-certification-data) because it cross-references docs/hardware-validation.md, which lands there. Merge #61 first and this retargets to main cleanly.

What drifted

Three spec pages still described the repo as it stood around 0.1.0a1, and in places said the opposite of what ships.

call-graph.md claimed "TDX/TPM backends are not implemented" and that peer attestation is "not yet wired into this call path". All three verifiers are implemented and fail-closed, and ca2a_runtime.attestation gates the seal on an appraised channel key. It also still listed the Cedar engine binding as pending (#10, merged).

component-model.md was the worst of it: the sealed channel described as "a placeholder that fails closed", the TEE layer as "interface only, hardware backends pending", no entry at all for peer, policy, cedar, transport, node, attestation or trace_binding, an error list three codes short, and two CLI subcommands where there are now three.

attestation.md said real-hardware validation "remains open" for SEV-SNP and TDX, which the runs in docs/hardware-validation.md have closed.

Corrections go both ways

Most of this understated what is built. Two places now state limits more sharply than before:

• TPM is called out explicitly as the one backend with no real quote behind it, rather than sitting in a list that makes it look equivalent to SEV-SNP and TDX.
• Step 2 says plainly that a completed software-mode call is not an attested one, and that off hardware the appraisal records assurance="none".

Style

No bold emphasis added, matching the house-style cleanup in #59. The first pass reintroduced it; caught and stripped.

Test plan

Docs only, no code touched. pytest tests/conformance — 30 passed.

🤖 Generated with Claude Code