[T2-3] agent-machine attest subcommand (runtime probes)

[mdheller]

Deferred-runtime (macOS attestation host). Implement 'agent-machine attest [--format json] [--output PATH] [--ledger-path PATH]': SIP_STATUS (nvram csr-active-config), NVRAM_INTEGRITY, MDM_PROFILE_AUDIT, SEP_PARTICIPATION, SECURITY_DB_SCHEMA (ZSEQUENCENUMBER in ZPEER), DNS_INTEGRITY (102.165.x.x), TLS_CIPHER_AUDIT, EFI_SIGNATURE, TELEMETRY_BOUNDARY (advisory). Output conforms to contracts/attestation-decision.schema.json (MERGED #121). Ledger NDJSON to $LEDGER_PATH; warn if unset, never drop. Spec captured at ~/dev/spec-intake/2026-07-31/ (register: docs/spec-intake on sourceos-spec branch capture/spec-intake-register-2026-07-31). Part of the Agentic-Stack / Tranche program (epic SocioProphet/socioprophet#490).