feat: trust/exposure fields — installVerification, keyPinned, exposure

Regenerated stubs for the additive proto: per-entry
StoreEntry.installVerification, StoreSource.keyPinned, the
ListStoresResponse policy snapshot (requireSignatures /
trustedPublisherCount) and DeclaredService.exposure. New
listStoresFull() exposes the response-level snapshot; listStores()
stays as the plain source list.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -6,6 +6,14 @@ for the authoritative per-release detail.
 
 ## Unreleased
 
+- Regenerated stubs for the trust/exposure proto additions:
+  `StoreEntry.installVerification` (pinned-key / trusted-publishers /
+  unverified / blocked / federated), `StoreSource.keyPinned`,
+  `ListStoresResponse.requireSignatures` / `trustedPublisherCount`,
+  `DeclaredService.exposure` (loopback/private/public/unknown).
+- New `listStoresFull()` returning the full response incl. the
+  policy snapshot; `listStores()` unchanged.
+
 - `InvocationList.detachedEnabled`: whether the operator enabled
   detached invocations — monitor UIs can distinguish "feature off"
   from "on, but no runs yet". Regenerated stubs.