feat(tpm): add read-only TPM validation

bible-local/docs/hardware-ingest-contract.md

@@ -763,6 +763,11 @@ PSU без `serial_number` игнорируется.
 }
 ```
 
+`bee` emits the following TPM keys in this object: `TpmPresent`, `TpmEnabled`,
+`TpmDevice`, `TpmInterface`, `TpmVersion`, `TpmManufacturer`, and
+`TpmFirmwareVersion`. Detection and identity collection are read-only; absent
+optional identity fields are omitted.
+
 ---
 
 ## Обработка статусов компонентов

bible-local/docs/validate-vs-burn.md

@@ -18,6 +18,7 @@ Tests on the **Validate** page are purely diagnostic. They:
 | Storage | `smartctl -a`, `nvme smart-log` — reads SMART data only |
 | CPU | `stress-ng` for a bounded duration; CPU-only, no I/O |
 | AMD GPU | `rocm-smi --showallinfo`, `dmidecode` — read-only queries |
+| TPM | `tpm2_getcap`, `tpm2_pcrread`, `tpm2_gettestresult` — read-only queries; does not start `TPM2_SelfTest` |
 
 ## Burn Tests (hardware wear)