cmcp_verify.nv_certify / nv_policy: verify_gateway_measurement accepts duplicate JSON keys, boolean/float version, non-base64 chars, and non-canonical gateway_digest hex #810

Summary

1. verify_gateway_measurement in src/cmcp_verify/nv_certify.py parses envelope with bare json.loads(envelope) (accepting duplicate JSON keys and NaN/Infinity), checks int(payload.get("v", 0)) != ENVELOPE_VERSION (accepting "v": true, "v": 1.9, and "v": "1"), decodes pre_attest/pre_signature/post_attest/post_signature with base64.b64decode(...) without validate=True or isinstance(..., str) (silently stripping non-base64 characters), and decodes gateway_digest via bytes.fromhex(...) without requiring canonical 64-char lowercase hex.
2. measurement_nv_public_bytes in src/cmcp_verify/nv_policy.py does not validate type(index) is int or isinstance(written, bool).