Application attestation handles this. Fortanix CCM generates the enclave hash (MRENCLAVE), signer (MRSIGNER), ISVPRODID, and ISVSVN during image conversion. These values are created by the enclave application and supplied in the attestation report. Before providing a certificate, Fortanix CCM verifies the report and the application's integrity. Deviations from these values imply tampering. Consequently, the application fails.
AWS nitro's first enclave image and measurement include the whole enclave filesystem. AWS nitro solutions are like SGX. The filesystem hash is stored in the enclave image and measurements.