Keep current and rollback PCR0s in Research and SDK bundles

[AnthonyRonning]

Research and the in-tree TypeScript/Rust SDKs now bundle only the current approved October 11 PCR0 and the verified October 9 rollback PCR0 for each environment. Current and rollback enclaves remain usable without a GitHub history fetch; other approved measurements continue through the existing signed-history fallback. The verification key, signed histories, environment separation, custom-root support and attestation checks remain unchanged.

Research's browser SDK pin remains @mapleai/sdk@4.0.1, which still contributes its 10 older built-in roots per environment alongside the two app-provided roots. Its effective combined browser trust therefore contains 12 roots per environment. Native consumers use the trimmed in-tree Rust SDK. Auth, application/package versions and publication workflows are unchanged.

Validation:

• 38 focused TypeScript PCR/session tests passed, with 127 assertions; three hosted-only tests were skipped. Coverage includes current/rollback static trust, opposite-environment rejection, unknown PCR rejection before key exchange, and genuine signed-history acceptance/rejection.
• All 10 Rust PCR-policy tests passed, including older-root rejection without history and valid/tampered signed-history checks.
• Required hooks passed: Research formatting/lint/typecheck and 1,304 tests; TypeScript SDK formatting/build and 258 tests; Rust formatting/Clippy/docs and 118 tests (one intentional ignored test).
• Independently verified all four retained PCR0 signatures against the unchanged P-384 key and checked that each belongs only to its intended approved history.

The optional hosted test now accommodates bundled trust as well as ordered signed-history trust, and its denial case explicitly selects production bundled trust for a development enclave. Existing unknown-PCR and signed-history unit coverage remains intact.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Maple development preview: https://0f4ccb8f.maple-ca8.pages.dev

Commit: 4f5ca0a0e70970bf7c5dabe11597835a3a1165d4

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.