feat(store,doctor): surface the hub's trust + exposure data (0.77.0)

The trust-gate dialog replaces its generic 'no per-entry status yet
(alpha)' note with the hub's classified verification statement —
pinned store key / trusted publishers (green), installs without
signature checking (amber), install would be refused (red), bridge
entry (neutral) — via one shared describeInstallVerification mapping.
Against a pre-0.23 hub the field is empty and the old honest wording
stays (pinned by test).

Information architecture: policy-off is a GLOBAL fact, so it appears
as ONE ChainInlineHelp notice above the store grid instead of a
warning pill on every card (card noise); only 'blocked' — a genuine
per-source anomaly — earns a card pill. Doctor's host services show
the hub-classified network reach per endpoint (local only / private
network / publicly reachable with a protect-it hint / reach unknown).

Verified end-to-end against the live dev hub (guide harness): the
wire field arrives, the store page shows exactly one policy notice
and quiet cards; trust-gate variants captured via the dialog
harness. Suite 123 green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -1213,6 +1213,12 @@
     }
   },
   "doctorSummaryDeclared": "declared",
+  "svcExposureLoopback": "local only",
+  "svcExposurePrivate": "private network",
+  "svcExposurePublic": "publicly reachable",
+  "svcExposureUnknown": "reach unknown",
+  "svcExposurePublicHint": "This service endpoint sits on a public address — make sure it is protected (TLS, auth, firewall).",
+  "svcExposureUnknownHint": "Hostname instead of an IP address — the hub deliberately does not resolve names to classify.",
   "doctorLinkStore": "Open the store",
   "doctorLinkApprovals": "Open approvals",
   "doctorLinkAudit": "Open the audit log",
@@ -1646,6 +1652,19 @@
   "installConfirmNeedsCapabilities": "Required capabilities",
   "installConfirmTrustTitle": "Trust & security",
   "installConfirmTrustBody": "The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.",
+  "storePolicyUnverifiedNotice": "Signature enforcement is switched off in the hub policy — installs are not cryptographically verified. The install dialog shows the per-module status; enable security.require_signatures for verified installs.",
+  "verifPillUnverified": "unsigned",
+  "verifPillBlocked": "blocked",
+  "verifPinnedKey": "Signature checked — pinned store key",
+  "verifPinnedKeyBody": "The hub verifies the bundle at install time against this source's pinned key. A tampered bundle is refused.",
+  "verifTrustedPublishers": "Signature checked — trusted publishers",
+  "verifTrustedPublishersBody": "The hub verifies the signature at install time against the trusted-publisher list. A bundle without a valid signature is refused.",
+  "verifUnverified": "Installs without signature checking",
+  "verifUnverifiedBody": "Signature enforcement is switched off in the hub policy — this bundle is not cryptographically verified at install time. Enable security.require_signatures for verified installs.",
+  "verifBlocked": "An install would be refused",
+  "verifBlockedBody": "The policy requires signatures, but no key material applies to this source — the hub would refuse the install.",
+  "verifFederated": "Connected via an integration — no bundle signature",
+  "verifFederatedBody": "This entry is not an installable bundle; it runs through a configured integration (e.g. MCP or n8n). There is no bundle signature — trust follows the integration.",
   "installConfirmSignatureNote": "The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).",
   "settingsSidebarPinnedTitle": "Keep the navigation expanded",
   "settingsSidebarPinnedBody": "Shows the sidebar labels permanently instead of only while hovering with the mouse.",