feat(tpm): add read-only TPM validation

bible-local/architecture/runtime-flows.md

@@ -149,7 +149,8 @@ Current validation state:
   5. pcie collector    (lspci -vmm -D, /sys/bus/pci/devices/)
   6. psu collector     (ipmitool fru + sdr — silent if no /dev/ipmi0)
   7. nvidia enrichment (nvidia-smi — skipped if binary absent or driver not loaded)
-  8. output JSON → /var/log/bee-audit.json
+  8. TPM inventory (sysfs presence + `tpm2_getcap properties-fixed`; no state changes)
+  9. output JSON → /var/log/bee-audit.json
 ```
 
 Every collector returns `nil, nil` on tool-not-found. Errors are logged, never fatal.
@@ -159,6 +160,7 @@ Acceptance flows:
 - NVIDIA GPU burn-in can use either `bee-gpu-burn` or `bee-john-gpu-stress` (John the Ripper jumbo via OpenCL)
 - `bee sat memory` → `memtester` archive
 - `bee sat storage` → SMART/NVMe diagnostic archive and short self-test trigger where supported
+- `bee` TPM Validate → read-only capabilities, PCR values, and existing self-test result; never starts `TPM2_SelfTest`
 - SAT `summary.txt` now includes `overall_status` and per-job `*_status` values (`OK`, `FAILED`, `UNSUPPORTED`)
 - `bee-gpu-burn` should prefer cuBLASLt GEMM load over the old integer/PTX burn path:
   - Ampere: `fp16` + `fp32`/TF32 tensor-core load

bible-local/architecture/system-overview.md

@@ -18,7 +18,7 @@ Fills gaps where Redfish/logpile is blind:
 
 ## In scope
 
-- Read-only hardware inventory: board, CPU, memory, storage, PCIe, PSU, GPU, NIC, RAID
+- Read-only hardware inventory: board, CPU, memory, storage, PCIe, PSU, GPU, NIC, RAID, TPM
 - Machine-readable health summary derived from collector verdicts
 - Operator-triggered acceptance tests for NVIDIA, memory, and storage
 - NVIDIA SAT includes diagnostic collection plus a lightweight in-image GPU stress step via `bee-gpu-burn`