Add scoped OpenSecret EIF approval checks

[AnthonyRonning]

Summary

Separate backend source validation from deployment-approval measurement parity.

• Add a read-only ubuntu-24.04-arm dev/prod EIF comparison workflow with independently reported matrix results.
• Split change detection into EIF build inputs (eif) and actual edits to the four approved dev/prod PCR JSON files (pcr_approvals). Validate the complete classifier output before exposing it to callers.
• Add a direct pinned-Nix build/comparison helper, routing and failure-path regressions, and updated operational/security guidance.

Trigger policy

Event/change	EIF comparison
Ordinary backend-source PR	Skip; fresh PCR approvals are not required
PR explicitly editing approved PCR snapshots or histories	Compare both dev and prod
Relevant backend/TEE, approval, or comparison-tool changes on master	Compare both; a mismatch deliberately remains red
Unrelated application, SDK, or documentation changes	Skip
Manual dispatch	Compare both

An indeterminate PR diff fails routing explicitly instead of inventing an approval edit. Master routing uncertainty conservatively enables comparisons. Existing Rust, Nix, SDK integration, audit, and signed-history validation remain separate.

Safety and scope

• Pinned actions, hosted runners, contents: read, no persisted checkout credentials, no signing/deployment credentials or artifact uploads.
• The helper rejects missing/non-regular files and fails on build errors or measurement mismatches. It does not load dotenv, enter development-shell hooks, rewrite approvals, or replace the operator's default result link.
• No backend runtime, dependency, PCR approval, signing-key, publication, deployment, or branch-protection changes.
• Nix uses normal cache semantics; this is measurement parity, not a forced independent rebuild or live-deployment proof.

Validation

• nix flake check --no-update-lock-file --print-build-logs: all 10 root checks passed on Linux ARM64.
• 60 focused routing/workflow tests passed, including merge-base selection, renamed/deleted approvals, routing failures, distinct dev/prod measurements, invalid artifacts, and non-mutating failure behavior.
• Workflow linting, bash -n scripts/ci/check_opensecret_eif.sh, and Git whitespace checks passed.
• Normal pre-commit hook passed frontend formatting, the frontend build, and 818 tests (0 failures).
• Confirmed unchanged PCR bundles, lockfiles, submodule pins, and protected local file metadata.

Other host platforms and actual hosted ARM64 EIF execution remain unverified. This PR intentionally does not select its own EIF jobs because it changes no PCR approvals; relevant master changes will select them after merge. A successful CI comparison does not authorize deployment or prove that canonical and legacy public PCR endpoints are synchronized.