Refresh matching EHBP endpoint, key, and proxy route

[jdrean]

Summary

• separate the caller-configured enclave constraint from the bundle-discovered runtime endpoint
• remove every SDK special case for inference.tinfoil.sh
• bind each EHBP sealing transport and verified proxy route in one immutable generation
• allow a real forwarding proxy to refresh the complete attested endpoint and HPKE key pair
• keep direct clients on the selected domain and explicitly configured clients pinned
• reject bundle-domain mismatches before accepting verification state
• delete the obsolete standalone header-routing layer and its dead tests

Security

A request is replayed only after the protocol-defined EHBP key-configuration mismatch signal. Replacement state must pass complete client-side attestation, and concurrent rotations cannot pair one generation's key with another generation's route.

Validation

• 482 non-integration tests passed
• 2 skipped, 24 live integration tests deselected
• git diff --check

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>