Trace: verify Pi control-plane attestation at push #3718

Problem

Pi's attestation-at-push matrix cell is Unknown because the default local E2E suite writes unsigned local evidence and does not exercise a control-plane upload.

Scope

Add an opt-in, isolated Pi control-plane smoke that verifies a signed session attestation for a traced push. This issue covers only upload and cryptographic attestation; the other Pi notification cells are tracked separately.

Acceptance criteria

• Provision an authorized disposable control-plane workflow; pin Pi, CLI, and model versions without using the local-only matrix runner.
• Make one Pi-traced commit and push it; retrieve and cryptographically verify the signed attestation.
• Match session ID, commit SHA, transcript, model, token usage, and attribution to the Pi run.
• Rejected credentials produce no upload. --require-trace blocks a failed push while default mode remains fail-open.
• Use event/state synchronization instead of fixed sleeps. Update only the attestation-at-push Pi matrix cell after the live assertions pass.

Non-goals

• Pi welcome notification (Trace: verify Pi interactive welcome message #3722).
• Credentials warning in Pi UI (Trace: verify Pi credentials warning #3723).
• Session URL after push (Trace: verify Pi post-push session link #3724), which depends on a successful upload here.
• Granting permission to a production Chainloop project or bypassing Pi project trust.

Baseline Pi support #3704. The original combined verification issue was narrowed to this one cell as part of the issue-first tracking pass.