fix: enable TDX config in trustee to point QCNL at local PCCS service

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: butler54

values-baremetal.yaml

@@ -119,6 +119,10 @@ clusterGroup:
           value: kbsres1
         - name: kbs.secretResources[0].key
           value: secret/data/hub/kbsres1
+        - name: kbs.tdx.enabled
+          value: "true"
+        - name: kbs.tdx.collateralService
+          value: "https://pccs-service.intel-dcap.svc.cluster.local:8042/sgx/certification/v4/"
         - name: kbs.secretResources[1].name
           value: passphrase
         - name: kbs.secretResources[1].key