fix(attestation): keep enclave exit hooks local in EMU

[Haitao Huang (haitaohuang)]

Summary

• Localize the enclave atexit and __cxa_atexit stubs in the application-only libservtd_attest_app.a. This avoids a duplicate atexit definition with glibc's libc_nonshared.a and lets host exit callbacks use libc.
• Leave the firmware libservtd_attest.a unchanged.
• Rescan libc after the late native archives in both hosted build scripts, so GNU ld resolves static OpenSSL's atexit reference as well as LLD does.
• Add a native regression for C/C++ exit callbacks, archive integrity, repeatability, and fatal objcopy failures; run it in the EMU workflow and local gauntlet.

Validation

• Native regression passed on Ubuntu 24.04 and Azure Linux 3.0.
• Full local CI gauntlet passed in Azure Linux 3.0 with Rust 1.95: all six stages, 32 image builds, and 18 EMU scenarios, including CoRIM migration/rebind and the required revoked-policy rejection.
• Reproduced the original glibc 2.38 linker failure and verified that the fix runs host exit callbacks without changing the firmware archive.
• Reproduced the GNU ld ordering failure, then verified the actual emitted linker directives with -fuse-ld=bfd -nodefaultlibs and built the real hosted binary with -C linker-features=-lld.

[Haitao Huang (haitaohuang)]

The GitHub GNU ld jobs exposed an additional archive-ordering dependency that the local LLD run did not: the late static libcrypto needs libc rescanned after its atexit reference. I reproduced this locally with a regression that reads both build scripts’ emitted library order and links with GNU ld plus -nodefaultlibs. Adding -lc after the native archives fixes that regression, and the real hosted binary now builds with GNU ld. Full local revalidation is running before the corrective update is pushed.

[Haitao Huang (haitaohuang)]

The corrective head 0817b81 is fully validated. All pull-request workflows passed, and the extra push-run job that hit a transient OpenSSL download TLS failure also passed on retry. All 116 check runs are now successful. Local verification also passed the complete gauntlet, the real GNU-linked hosted build, and the native regression for library ordering, exit callbacks, archive integrity, and failure propagation.