docs(verifier): say os_image_is_dev is only reported on the TDX legacy path

[kvinwang]

Problem

verifier/README.md told relying parties to reject dev images via os_image_is_dev, and said it is null only on GCP TDX and Nitro Enclave. In fact the only assignment is on the TDX legacy path (the only path that downloads the image and reads metadata.json). TDX lite, SEV-SNP, GCP TDX, AWS NitroTPM and Nitro Enclave carry only the manifest digest, so the field is always null there, and a "reject if os_image_is_dev == true" policy accepts every dev image on those paths. The README also did not say that is_valid ignores tcb_status.

Fix

Docs only: state where os_image_is_dev/os_image_version are reported, tell relying parties to allowlist os_image_hash instead, and note that tcb_status is surfaced, not gated (linking the existing security-model section).

Verification

cargo test -p dstack-verifier, fmt and clippy clean (no code change beyond doc comments).

The measurement-cache bound from the original PR is #1369, and the report_data domain-tag section is #1370.