Add native full-build v2 snapshot evidence

[weikengchen]

Summary

• add native v2 root-bundle payload and predecessor-free full_build evidence for snapshot builds
• stage Direct ORAM inputs and bind them into the final server manifest before evidence generation
• keep the legacy v1 and roots-only paths unchanged while rejecting v2 roots-only builds
• accept only the exact valid empty single-bin tree-top encoding produced by the writer

Why

Production snapshot builds need one internally consistent generation for the runtime database, proof directory, Direct ORAM inputs, and v2 attestation evidence. The existing v2 path only re-attested an earlier v1 proof and could not represent a native full build.

Validation

• cargo test -p dbpipeline existing_onion_layout_v2_accepts_only_empty_single_bin_tree_tops
• cargo test -p pir-attested-builder (31 passed)
• bash -n scripts/build-snapshot-database.sh scripts/local-regtest-e2e.sh
• scripts/local-regtest-e2e.sh
• cargo check -p pir-attested-builder
• Rust formatting check
• git diff --check

No SEV, mainnet, browser, or production operation was performed.