Enforce environment-scoped PCR0 trust in maple-proxy

[AnthonyRonning]

Summary

• bump maple-proxy to 0.3.0 and consume published opensecret 3.6.0
• add explicit production | development PCR0 trust selection across CLI, environment, and library configuration
• default every omitted selection to production; development requires an exact explicit opt-in
• pass the selected environment into the SDK before attestation handshake and key exchange
• propagate the production-default setting through Docker, Compose, just recipes, examples, and documentation
• remove the deprecated OpenClaw plugin package and its build, publish, documentation, and Nix hooks

Compatibility

• REST routes and request/response schemas are unchanged
• Config::new remains available and now defaults to production trust
• the public configuration contract gains PCR0 environment selection, so this is a pre-1.0 minor release
• invalid environment values fail during startup rather than falling back
• this supersedes the older SDK pin in draft PR Pin Sigstore-enforcing OpenSecret SDK #48

Validation

• just check-all: formatting, strict Clippy, 24 unit tests, and 3 integration tests
• cargo test --locked --all-features: 27 passed
• cargo package --locked --allow-dirty: packaged and verified maple-proxy 0.3.0
• Rust documentation and Nix flake evaluation passed
• hosted development enclave with explicit development completed attestation and reached the encrypted upstream
• the same development endpoint with the selector omitted logged Production and rejected PCR0 before transport
• fresh read-only security/release review found no blockers
• all Rust, Actions, cross-platform release, Docker, and security-audit CI jobs pass

CodeQL configuration follow-up

GitHub default CodeQL setup still schedules javascript-typescript because OpenClaw existed on the base branch. After this PR removes the final JS/TS source, that stale language job reports No source code was seen during the build; Rust and Actions CodeQL both pass. Remove JavaScript/TypeScript from the repository default-setup language list after merge.