fix(tdx): bind verification to signed quote header - #374

This PR is awaiting a named-maintainer review of the current head commit. This is a policy gate, not a CI failure: the PR is mergeable once a named maintainer approves. Approvals of earlier commits do not count after new pushes. See CODEOWNERS or MAINTAINERS.md for the list of maintainers.