Feat/tee

[chudkowsky]

Summary

This PR introduces TEE (Trusted Execution Environment) support and restructures the binary layout to eliminate native library conflicts between STARK and TEE dependency trees.

Workspace split

`bin/saya` is dissolved. Each binary now lives in its own isolated Cargo workspace with its own lock file:

Binary	Crate	Purpose
`bin/persistent`	`persistent`	STARK-based proving via Atlantic/Piltover
`bin/persistent-tee`	`persistent-tee`	TEE-based proving + attestation
`bin/ops`	`ops`	On-chain ops (formerly `bin/core-contract`)

Why: `c-kzg` (pulled by SNOS) and `katana-tee` deps cannot coexist in a single workspace — they pull in conflicting native libraries. Separate workspaces give each binary an independent resolver.

saya-core is now pure infrastructure

All STARK-specific code (Atlantic HTTP client, mock prover, sovereign/persistent orchestrators, Piltover settlement, utils) moves from `saya-core` into `bin/persistent`. `saya-core` retains only block ingestor, storage, DA traits, and service primitives — plus a new optional `snos` feature for `SovereignPacket` impls that would otherwise violate the orphan rule.

TEE integration (`bin/persistent-tee` + `saya/core`)

New modules added:

• `saya/core/src/orchestrator/tee.rs` — TEE orchestration loop
• `saya/core/src/prover/tee/` — TEE prover trait impl
• `saya/core/src/tee/` — shared TEE types
• `saya/core/src/block_ingestor/polling.rs` — polling-based ingestor for TEE workflows
• `bin/persistent-tee/src/attestor.rs` — remote attestation
• `bin/persistent-tee/src/prover.rs` / `prover_impl.rs` — TEE proof generation
• `bin/persistent-tee/src/settlement.rs` — TEE settlement flow

CLI change

`persistent persistent start` is flattened to `persistent start` by removing the `Persistent` wrapper struct.

Docker / CI fixes

• Build both isolated workspaces (`bin/persistent`, `bin/ops`) with separate `--manifest-path` invocations
• Generate `layout_bridge.json` inside the build stage (eliminates dependency on a pre-populated `programs/` directory that is gitignored and absent in CI)
• Create cairo-lang venv from `requirements.txt`; switch to `openssl-dev` + `openssl-libs-static` for musl static linking
• Bump `rust-toolchain.toml` to 1.89 (required by transitive dojo-utils deps)
• `compose.yml` uses `${SAYA_IMAGE:-ghcr.io/dojoengine/saya:feat-tee}` — image managed via compose, e2e CI no longer builds from source
• e2e CI toolchain bumped to 1.89, `build-image` job removed

Compose / e2e fixes

• Updated piltover contract address and `sn_msg` messaging contract address after class hash change
• Added `sleep 2` between `sozo declare` and `sozo deploy` in `appc_msg_sn_deploy` to avoid nonce race
• Lowered `--settlement-contract-deployed-block` default from 4 → 1 to avoid `ContractNotFound` panic in `katana_init` when parallel services produce nondeterministic block ordering
• `compose_up()` in e2e test helper now calls `compose_down()` first for a clean slate

Testing

• All 17 unit tests pass (`cargo test --workspace --all-features --exclude saya-e2e`)
• `e2e-settlement`: `test_program_info_and_fact_registry`, `test_settlement_advances_after_genesis` — pass
• `e2e-messaging`: `test_l2_to_l3_message`, `test_l3_to_l2_message` — pass