feat(deploy_tee)!: POST the reth genesis; found networks from a network dir

[samlaf]

Two related changes, verified live together at N=2 (cohort configure → attested root_key fetch → genesis ceremony → 2-validator quorum, blocks advancing on both nodes):

reth genesis delivery. configure (both CLIs) now POSTs the chain spec alongside the manifest — [network].reth_genesis_base64, defaulting to the reth-genesis.json beside --manifest and chainId-checked client-side (the mirror of tdx-init's POST-time check). Pairs with enclave#199 and seismic-images#39 (the image no longer bakes a chain spec); the dev stack pin moves to the seismic-dev_2026-07-02.5c3b5e image.

Network-directory founding workflow. One directory per network holds the three authored inputs and the derived artifact set beside them — the committable record of everything needed to (re)configure, join, or debug the network:

• manifest init DIR scaffolds the inputs: chain spec + measurements are copied in (external facts init cannot invent; --measurement-id is stamped into measurements.json, normalized to the artifact basename), and a starter summit template is generated (namespace = DIR basename) unless one is supplied to copy.
• manifest assemble DIR derives network-manifest.json, measurement-policy.json, and the shipped template copy, filling the template's derived/parser-required fields: eth_genesis_hash (computed from the reth genesis; a declared value is replaced, so shipped bytes never carry a stale hash) and an empty validators = [] (summit's genesis binary requires the key to parse; it replaces the value from -v). manifest validate DIR re-audits a set at rest.
• up --network DIR refuses to provision when the config's vhd_blob_url basename is not one of the policy's measurement_id records (name-level stale-pin tripwire — attestation remains the cryptographic gate) and writes the cohort descriptors to DIR/nodes/ (gitignored infra state, unlike the artifacts around them); down --network DIR cleans them up.
• genesis is renamed genesis-ceremony (one-shot: send_genesis exists only in the pre-genesis node API) and now verifies its template against the manifest's summit.genesis_template_hash before building anything; --summit-template and --node default from the network directory.

BREAKING: manifest assemble/validate take the network directory as their sole positional argument (per-file flags removed; init is the only command that takes loose files), and seismic-tee-bootstrap genesis is now genesis-ceremony.