Replace verify subcommands with passthrough to secretvm-verify

[azaidelson]

Summary

• Drops the three verify quote / verify workload / verify proof-of-cloud subcommands and replaces them with a single verify passthrough that spawns the secretvm-verify binary with the user's args forwarded verbatim.
• Adds one CLI-specific option, --vm-id <id>, which resolves to a hostname via the portal API and injects --vm <host> (or --secretvm <host> if no other verb flag is present) before forwarding.
• Output is byte-identical to running secretvm-verify directly. Help output rewrites secretvm-verify → secretvm-cli verify in usage examples and prepends a one-line note showing the upstream version.
• Drops secretvm-verification-sdk, adds secretvm-verify@^0.8.4.

Why

Maintaining a parallel CLI surface in this repo was costing flag drift, output-shape divergence, and missed upstream improvements. secretvm-verify already has its own well-maintained CLI with a richer feature set (--cpu, --tdx, --sev, --gpu, --secretvm, --verify-workload, --resolve-version, --check-agent, --agent, --compose, plus modifiers like --docker-files, --proof-of-cloud, --show-compose, --json, --raw, --verbose). Forwarding to it gives us one source of truth and automatic feature parity.

Breaking changes

• secretvm-cli verify quote ... / verify workload ... / verify proof-of-cloud ... no longer exist. Migrate to the upstream flag form:
  • verify quote --quote-file x.txt → verify --cpu x.txt
  • verify workload --quote-file q.txt -d compose.yaml → verify --verify-workload q.txt --compose compose.yaml
  • verify proof-of-cloud --quote-file q.txt → verify --proof-of-cloud --cpu q.txt
• These commands shipped only in v0.8.0 and aren't widely deployed, so blast radius is small.

Design + plan docs

• Spec: docs/superpowers/specs/2026-04-24-verify-passthrough-design.md
• Plan: docs/superpowers/plans/2026-04-24-verify-passthrough.md

Test plan

• secretvm-cli verify (no args) → banner with upstream version + upstream usage, all examples shown as secretvm-cli verify ....
• secretvm-cli verify --help → same as above.
• secretvm-cli verify --cpu <quote> → output matches npx secretvm-verify --cpu <quote> byte-for-byte.
• secretvm-cli verify --json --cpu <quote> → upstream JSON output.
• secretvm-cli verify --secretvm <host> → end-to-end check against a live SecretVM.
• secretvm-cli verify --vm-id <id> (logged in) → portal lookup → forwards as --secretvm <host>.
• secretvm-cli verify --cpu --vm-id <id> → forwards as --cpu --vm <host>.
• secretvm-cli verify --secretvm foo --vm-id bar → clean single-line error, exit 1, no stack trace.
• secretvm-cli verify --cpu /dev/null → upstream's failure output, exit 1 propagates.