[codex] Add AWS EC2 Nitro image support

[h4x3rotab]

Summary

Adds the Yocto layer pieces needed for AWS EC2 NitroTPM boot support.

This includes:

• a dstack-aws kernel feature fragment for EC2 Nitro devices;
• built-in NVMe root disk support for EBS root volumes;
• built-in ENA networking support;
• UEFI/GPT and serial console support for EC2 boot/debugging;
• built-in TPM CRB support for NitroTPM;
• tpm2-tss as a dstack-guest build dependency.

Depends on the dstack platform implementation in Dstack-TEE/dstack#753.

Validation

• git diff --cached --check before commit
• the AWS hardened image was built on phala-onprem rather than locally
• live EC2 smoke passed against the promoted Attestable AMI recorded in Add AWS EC2 NitroTPM attestation and guest OS support dstack#753

Notes

The local checkout still has a dirty nested dstack submodule working tree from the implementation/testing workspace. This PR intentionally commits only the meta-layer recipe and kernel feature changes; the dstack code changes live in Dstack-TEE/dstack#753.

[kvinwang]

Combined into Dstack-TEE/dstack#753 after the monorepo merge. The Yocto changes now live under os/yocto/layers/meta-dstack/ in that PR.