Tee audit 2 fixes

[roger-bai-coinbase]

Summary

Hardens NitroEnclaveVerifier journal verification around certificate expiry and audit follow-ups.

Changes

• After trusted-prefix checks, reject verification when any remaining certificate in the journal chain has a notAfter before block.timestamp (audit finding 1).
• Remove stale or misleading comments (finding 3).
• Document that a revoked intermediate can become trusted again if re-added with a new expiry (finding 5).
• Add a test that an expired leaf past trustedCertsPrefixLen yields InvalidTimestamp and is not cached.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1