feat: SAS-R0 boot-time capability attestation - unimplemented feature blocks boot

- attest.c: subsystems report readiness, attest_check() before DSK handoff

- FUCK [attest] require_<name>=1 (default) + not-ready -> lotus panic with feature errcode

- wired: sealed_mem/pckc/sched/drr/fs_fat32_rw/net_wired + placeholders (pkg/brand/dkm/nvme/virtio/wlan/vmx/drr_real_mac)

- negative test: require_pkg=1 -> boot-time PKG-E10 panic (verified); dev/release FUCK whitelist = STATUS.md undone items

- CLAUDE.md whitelist rule updated

CODE/UTSM/include/utsm/net.h

@@ -84,6 +84,9 @@ typedef struct dkm_net_api {
 } dkm_net_api;
 
 void net_init(void);
+
+/* attest: 有线/无线设备计数（启动期能力证明用，见 utsm/attest.h） */
+void net_attest_counts(u32 *out_total, u32 *out_wireless);
 const dkm_net_api *net_get_api(void);
 
 #endif