feat(tpm): add read-only TPM validation

bible-local/architecture/runtime-flows.md

@@ -149,7 +149,8 @@ Current validation state:
   5. pcie collector    (lspci -vmm -D, /sys/bus/pci/devices/)
   6. psu collector     (ipmitool fru + sdr — silent if no /dev/ipmi0)
   7. nvidia enrichment (nvidia-smi — skipped if binary absent or driver not loaded)
-  8. output JSON → /var/log/bee-audit.json
+  8. TPM inventory (sysfs presence + `tpm2_getcap properties-fixed`; no state changes)
+  9. output JSON → /var/log/bee-audit.json
 ```
 
 Every collector returns `nil, nil` on tool-not-found. Errors are logged, never fatal.
@@ -159,6 +160,7 @@ Acceptance flows:
 - NVIDIA GPU burn-in can use either `bee-gpu-burn` or `bee-john-gpu-stress` (John the Ripper jumbo via OpenCL)
 - `bee sat memory` → `memtester` archive
 - `bee sat storage` → SMART/NVMe diagnostic archive and short self-test trigger where supported
+- `bee` TPM Validate → read-only capabilities, PCR values, and existing self-test result; never starts `TPM2_SelfTest`
 - SAT `summary.txt` now includes `overall_status` and per-job `*_status` values (`OK`, `FAILED`, `UNSUPPORTED`)
 - `bee-gpu-burn` should prefer cuBLASLt GEMM load over the old integer/PTX burn path:
   - Ampere: `fp16` + `fp32`/TF32 tensor-core load