feat(verifier): report dev/prod OS image and deployment identity in result

[h4x3rotab]

Problem

dstack-verifier's verification result says whether a CVM is trustworthy, but not what it is running. In particular it never told a relying party whether the attested CVM runs a dev or prod OS image — a distinction that matters because dev images are built for local testing and aren't hardened for production. The verifier already reads the image's metadata.json (to compute expected measurements) and already holds several other identity signals, but dropped them on the floor.

What changed

Surface four descriptive fields in details so a relying party can apply its own policy:

Field	Type	Source	Trust basis
os_image_is_dev	bool?	image metadata.json	bound to os_image_hash
os_image_version	string?	image metadata.json	bound to os_image_hash
tee_platform	string? (tdx/gcp-tdx/nitro)	verified quote variant	from the verified quote
key_provider	{name,id}?	decoded app_info.key_provider_info	from the verified event log

Why these are trustworthy (not cosmetic)

os_image_is_dev / os_image_version are read from metadata.json, which is part of sha256sum.txt and therefore bound to the os_image_hash that the verifier checks against the quote — so they are as trustworthy as the existing os-image-hash verification. Fields are null when the platform doesn't expose them (GCP TDX / Nitro) or when an image predates the field (such images are always production).

A key_provider.name of local (rather than kms) is itself a useful "not KMS-backed" posture signal alongside os_image_is_dev.

Implementation notes

• is_dev + version added to dstack_types::ImageInfo (both #[serde(default)]) so the canonical metadata struct stops discarding them. No in-repo writers of that struct; meta-dstack already emits is_dev/version in the bundle (the VMM's own ImageInfo has read is_dev since Apr 2025).
• tee_platform set right after quote verification; key_provider decoded (best-effort) from the JSON blob already present as raw hex in app_info.
• Cleanups: the dstack-tdx path now downloads the image once (was downloading twice); the two VerificationDetails struct literals collapsed to Default so future fields don't need editing in three places.

cargo clippy -D warnings clean. README updated (response example + an "Identifying the deployment" section).

Release

Includes a chore: bump version to 0.5.12 commit (workspace Cargo.toml + Cargo.lock) so this is tag-ready on merge — verifier-v0.5.11 already exists, so the next verifier release is verifier-v0.5.12. After merge, pushing the verifier-v0.5.12 tag triggers verifier-release.yml (Docker build/push + GitHub release).

🤖 Generated with Claude Code