Fix RIP-201 bucket normalization spoofing

[liu971227-sys]

Summary

• reject PowerPC/G4-G5 claims whose CPU brand string does not match PowerPC hardware
• require PowerPC-specific SIMD evidence and cache-timing evidence before granting a vintage PowerPC classification
• derive stored attestation family/arch and enrollment weight from verified server-side signals instead of raw claimed device_arch
• convert the RIP-201 bucket normalization spoofing PoC #551 spoof regression tests into fix-verification coverage and update related fingerprint timing tests

Validation

• python -m pytest tests/test_rip201_bucket_spoof.py -v
• python -m pytest tests/test_fingerprint_improved.py tests/test_fingerprint.py tests/test_rip201_bucket_spoof.py -q

Bounty

• Closes rustchain-bounties#554
• Follow-up to the merged PoC in Rustchain#551
• Wallet: RTCa320f4334e7500987bce2fa0475f089ae9cd90e3