fix: add missing env var binding for tls.public.skip_verify

ATTESTATION_SERVER_TLS_PUBLIC_SKIP_VERIFY was documented but had no
viper.BindEnv call, so the env var was silently ignored. Also add
missing explicit defaults for report.user_data.env and
tls.public.skip_verify for consistency with other settings.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: sangwa

cmd/root.go

@@ -55,6 +55,7 @@ func initConfig() {
 	viper.SetDefault("server.port", 8187)
 	viper.SetDefault("paths.build_info", "/etc/build-info.json")
 	viper.SetDefault("paths.endorsements", "/etc/endorsements.json")
+	viper.SetDefault("report.user_data.env", []string{})
 	viper.SetDefault("report.evidence.nitronsm", false)
 	viper.SetDefault("report.evidence.nitrotpm", false)
 	viper.SetDefault("report.evidence.sevsnp", false)
@@ -75,6 +76,7 @@ func initConfig() {
 	viper.SetDefault("endorsements.client.timeout", "10s")
 	viper.SetDefault("http.allow_proxy", false)
 	viper.SetDefault("http.cache.size", "100MiB")
+	viper.SetDefault("tls.public.skip_verify", false)
 	viper.SetDefault("endorsements.cosign.verify", true)
 	viper.SetDefault("endorsements.cosign.url_suffix", ".sig")
 	viper.SetDefault("endorsements.cosign.tuf_cache_path", "")
@@ -90,6 +92,7 @@ func initConfig() {
 	_ = viper.BindEnv("paths.endorsements", "ATTESTATION_SERVER_PATHS_ENDORSEMENTS")
 	_ = viper.BindEnv("tls.public.cert_path", "ATTESTATION_SERVER_TLS_PUBLIC_CERT_PATH")
 	_ = viper.BindEnv("tls.public.key_path", "ATTESTATION_SERVER_TLS_PUBLIC_KEY_PATH")
+	_ = viper.BindEnv("tls.public.skip_verify", "ATTESTATION_SERVER_TLS_PUBLIC_SKIP_VERIFY")
 	_ = viper.BindEnv("tls.private.cert_path", "ATTESTATION_SERVER_TLS_PRIVATE_CERT_PATH")
 	_ = viper.BindEnv("tls.private.key_path", "ATTESTATION_SERVER_TLS_PRIVATE_KEY_PATH")
 	_ = viper.BindEnv("tls.private.ca_path", "ATTESTATION_SERVER_TLS_PRIVATE_CA_PATH")