docs: correct Cobalt TEE feature summary to registration migration

[roethke]

What changed? Why?

The TEE Migration accordion on the Cobalt overview says Cobalt "migrates Base infrastructure to run inside a Trusted Execution Environment (TEE)" and that specs are pending. That describes the wrong feature. The actual work, specified in #1953, keeps the existing TEE setup and changes only how new TEE signers are registered: the registrar verifies AWS Nitro attestations onchain using checked P-384 hints, replacing the RISC Zero and Boundless proving flow.

This PR:

• Retitles the accordion TEE Migration → TEE Registration Migration, matching docs: add Upcoming Features page for planned protocol work #1953 and its Upcoming Features entry.
• Rewrites the summary to cover the hinted P-384 verification, the removed external proving dependency, certificate caching (5 transactions cold → 1 fully cached), and what is unchanged (enclave key generation, PCR0 image selection, proof verification).
• Links the Registrar spec, which exists on master today. docs: add Upcoming Features page for planned protocol work #1953 rewrites that page and adds a hinted-tee-registration companion; if docs: add Upcoming Features page for planned protocol work #1953 lands first, this link is a candidate to repoint there.
• Updates the page description and the two matching generated index lines in llms.txt / llms-full.txt.

Notes to reviewers

Two things worth a look:

• Anchor change. The retitle moves the deep link from #tee-migration to #tee-registration-migration. Mintlify does not redirect heading anchors, so any external link to the old anchor lands on the page top. Happy to keep the original title if that matters more than matching docs: add Upcoming Features page for planned protocol work #1953's naming.
• Index files edited by hand. Running node scripts/llms.js regenerated unrelated drift against master (Tokenized Stocks entries, and a specifications/b20 → specifications/b20/index URL change). I reverted that and applied only the one Cobalt description line to each file to keep the diff scoped. The generator drift looks worth a separate fix.

How has it been tested?

• node scripts/validate-docs-structure.js passes
• node scripts/check-terminology.js passes
• node scripts/lint-mdx.js docs/upgrades/cobalt/overview.mdx: 0 errors, 0 warnings

Screenshots

Pending. Text-only change to one accordion body; the Mintlify preview renders it.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
base	🟢 Ready	View Preview	Sep 25, 2026, 7:01 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1

[roethke]

Thanks @leopoldjoy, all three applied in a82e058:

1. Trustlessly and fully onchain — added, exactly as suggested.
2. Certificate caching — dropped. Agreed it's misleading at a high level given the count depends on cache recency.

Updated summary:

Cobalt changes how new Trusted Execution Environment (TEE) signers are registered: the registrar verifies AWS Nitro attestations trustlessly and fully onchain using checked P-384 hints, replacing the RISC Zero and Boundless proving flow. Registration is faster and no longer depends on an external offchain proving service. Enclave key generation, PCR0 image selection, and proof verification are unchanged. See Registrar for the full specification.

Also merged master in, since the branch had picked up a merge commit on GitHub. Structure, terminology, and MDX lint checks still pass.