feat(store,doctor): surface the hub's trust + exposure data (0.77.0)

The trust-gate dialog replaces its generic 'no per-entry status yet
(alpha)' note with the hub's classified verification statement —
pinned store key / trusted publishers (green), installs without
signature checking (amber), install would be refused (red), bridge
entry (neutral) — via one shared describeInstallVerification mapping.
Against a pre-0.23 hub the field is empty and the old honest wording
stays (pinned by test).

Information architecture: policy-off is a GLOBAL fact, so it appears
as ONE ChainInlineHelp notice above the store grid instead of a
warning pill on every card (card noise); only 'blocked' — a genuine
per-source anomaly — earns a card pill. Doctor's host services show
the hub-classified network reach per endpoint (local only / private
network / publicly reachable with a protect-it hint / reach unknown).

Verified end-to-end against the live dev hub (guide harness): the
wire field arrives, the store page shows exactly one policy notice
and quiet cards; trust-gate variants captured via the dialog
harness. Suite 123 green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -6,6 +6,28 @@ lockstep.
 
 ## Unreleased
 
+### Added — real trust + exposure data (0.77.0)
+
+- **Per-entry install verification.** The hub now reports (since
+  0.23) how an install of each store entry would be verified under
+  the CURRENT policy — computed with the same resolvers the install
+  gate enforces, so display and enforcement cannot disagree. The
+  trust-gate dialog replaces its generic "no per-entry status yet
+  (alpha)" note with the classified statement: signature checked
+  via pinned store key / trusted publishers (green), installs
+  without signature checking (amber, policy off), install would be
+  refused (red), or bridge entry without a bundle signature. Store
+  cards stay quiet on the good path and wear an "unsigned"/
+  "blocked" warning pill only when installs are unverified —
+  same philosophy as the provenance pill. Against a pre-0.23 hub
+  everything keeps the old honest wording.
+- **Service exposure on the doctor page.** Every declared host
+  service shows its network reach as classified by the hub from
+  the endpoint host (local only / private network / publicly
+  reachable / reach unknown — no DNS lookups). Publicly reachable
+  endpoints get the warning tone with a "make sure it is
+  protected" hint.
+
 ### Added — explain it where it happens (0.76.0)
 
 - **In-place help pattern.** New `ChainInlineHelp` (a one-sentence