feat(tpm): add read-only TPM validation

audit/internal/platform/tpm.go

@@ -0,0 +1,19 @@
+package platform
+
+import "context"
+
+// RunTPMValidationPack verifies TPM 2.0 communication using read-only
+// commands. It deliberately excludes SelfTest, provisioning, NV writes, PCR
+// changes, key creation, and ownership operations.
+func (s *System) RunTPMValidationPack(ctx context.Context, baseDir string, logFunc func(string)) (string, error) {
+	return runAcceptancePackCtx(ctx, baseDir, "tpm", tpmValidationJobs(), logFunc)
+}
+
+func tpmValidationJobs() []satJob {
+	return []satJob{
+		{name: "01-properties-fixed.log", cmd: []string{"tpm2_getcap", "properties-fixed"}},
+		{name: "02-pcr-banks.log", cmd: []string{"tpm2_getcap", "pcrs"}},
+		{name: "03-pcr-values.log", cmd: []string{"tpm2_pcrread"}},
+		{name: "04-test-result.log", cmd: []string{"tpm2_gettestresult"}},
+	}
+}