Hosted Home: run in a confidential VM that the user's client verifies by attestation #212

Part of #209 (user keys and private data that the host cannot read).

Signatures prove what code was published, not what code a server runs: root on the host can run a different binary or read process memory. A confidential VM or enclave (for example AMD SEV-SNP or Intel TDX) keeps memory unreadable to the host, and remote attestation proves which build runs. A plain VM per user separates users from each other, not from the operator.

Done means

• The hosted Runtime runs in a confidential VM or enclave on hardware or a cloud that supports it; the choice and its cost are recorded here.
• Its attestation names the exact signed ElastOS build (release hash and maintainer DID). The user's client (from the hosted client issue) checks the attestation before releasing any key. Test: a modified build, or a VM without valid attestation, receives no key.
• The docs state what the operator can still do (deny service, see traffic sizes and timing) and what it cannot (read keys or private data).