[FIX] bump cofhe-keys to the six-partner mainnet set, and test that every baked env is complete

[haimbj1]

Problem

tdx-signer pins cofhe-keys at 84028ad (2026-09-17). At that rev, mainnet partner slot 6 is still the placeholder FILL-ME-PARTNER-6. The keygen repo filled it one day later, in 0e15839.

The read path calls partner_refs, which fails closed on a placeholder. So a zee-k image at this rev cannot boot with COFHE_ENV=mainnet. The v1.0.2 pin 291fcd71… was built at this rev.

Nothing caught it, because no reader ever booted with mainnet. The existing test config_env_mainnet_resolves_baked_partners checks partners.len() == 6, and a placeholder still counts as one of the six.

Changes

• cofhe-keys → 7f93823. That is keygen main, and the exact commit of the keygen release image sha256:f2ea9c48…. Writer and readers now bake the same partner map.
  • Cargo.lock also moves windows-sys 0.60.2 → 0.61.2 in some dependency lists. That package is Windows-only and does not reach the Linux image.
• New test every_baked_env_resolves_a_complete_partner_set. It runs the boot's own partner_refs(…, "zee-k", …) call for every baked env. A stale rev now fails CI, not a VM boot.

Proof

	new test
at 84028ad	fails: partner set is incomplete: ["FILL-ME-PARTNER-6"] still is a placeholder
at 7f93823	passes

After merge

The release build runs on push to main, so it gives a boot-checked, attested image at the new rev. That digest can be the zee-k pin for KSH v1.0.3.