fix(tee-simulator): generate ACPI event digests

[kvinwang]

Summary

• generate the lite-TDX ACPI loader, RSDP, and tables digests from the configured VM measurement
• patch the simulator CCEL before calculating RTMR values and publishing it to the guest
• add a regression test that compares CCEL ACPI events with the generated digests

Why

The simulator combined the current vm_config with stale ACPI digests from its bundled CCEL fixture after #1053. This produced internally inconsistent simulated evidence that the verifier correctly rejected.

Testing

• cargo fmt --manifest-path dstack/Cargo.toml --all --check
• cargo test --manifest-path dstack/Cargo.toml -p dstack-tee-simulator
• lite-TDX attestation Docker e2e (is_valid, quote, event log, OS image hash, and ACPI tables all verified)

[Copilot]

Pull request overview

This PR fixes the TDX tee-simulator’s simulated evidence consistency by regenerating the ACPI-related RTMR0 digests from the configured VM measurement and patching the CCEL fixture accordingly before replaying RTMRs and emitting the CCEL to the guest.

Changes:

• Add ccel_for_config() to patch the bundled CCEL fixture’s ACPI event digests to match expected_rtmr0_acpi_hashes() derived from vm_config.
• Ensure RTMR replay/quote generation uses the patched CCEL when a measurement document is provided.
• Add a regression test asserting the CCEL ACPI event digests match the generated expected digests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.