cmcp_verify.sev_snp / tpm: verify_sev_snp_measurement does not validate measurement hex characters or report_data_hex format, and _valid_measurement accepts whitespace/uppercase hex #811

Summary

1. verify_sev_snp_measurement in src/cmcp_verify/sev_snp.py checks measurement.startswith("sha384:") and len(hex_part) == 96, but never checks whether hex_part is valid hexadecimal (nor isinstance(measurement, str)), so "sha384:" + "z" * 96 passes Step 1 format validation.
2. In verify_sev_snp_measurement, report_data_hex[:128] silently truncates strings longer than 128 hex characters, and malformed report_data_hex raises ValueError inside the parse_snp_report try block and is misreported as failure_reason="raw_evidence_parse_error" instead of "report_data_mismatch".
3. _valid_measurement in src/cmcp_verify/tpm.py uses bytes.fromhex(hex_part) without checking isinstance(measurement, str) or rejecting whitespace/uppercase hex.