feat(store,doctor): surface the hub's trust + exposure data (0.77.0)

The trust-gate dialog replaces its generic 'no per-entry status yet
(alpha)' note with the hub's classified verification statement —
pinned store key / trusted publishers (green), installs without
signature checking (amber), install would be refused (red), bridge
entry (neutral) — via one shared describeInstallVerification mapping.
Against a pre-0.23 hub the field is empty and the old honest wording
stays (pinned by test).

Information architecture: policy-off is a GLOBAL fact, so it appears
as ONE ChainInlineHelp notice above the store grid instead of a
warning pill on every card (card noise); only 'blocked' — a genuine
per-source anomaly — earns a card pill. Doctor's host services show
the hub-classified network reach per endpoint (local only / private
network / publicly reachable with a protect-it hint / reach unknown).

Verified end-to-end against the live dev hub (guide harness): the
wire field arrives, the store page shows exactly one policy notice
and quiet cards; trust-gate variants captured via the dialog
harness. Suite 123 green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations.dart

@@ -3692,6 +3692,42 @@ abstract class AppLocalizations {
   /// **'declared'**
   String get doctorSummaryDeclared;
 
+  /// No description provided for @svcExposureLoopback.
+  ///
+  /// In en, this message translates to:
+  /// **'local only'**
+  String get svcExposureLoopback;
+
+  /// No description provided for @svcExposurePrivate.
+  ///
+  /// In en, this message translates to:
+  /// **'private network'**
+  String get svcExposurePrivate;
+
+  /// No description provided for @svcExposurePublic.
+  ///
+  /// In en, this message translates to:
+  /// **'publicly reachable'**
+  String get svcExposurePublic;
+
+  /// No description provided for @svcExposureUnknown.
+  ///
+  /// In en, this message translates to:
+  /// **'reach unknown'**
+  String get svcExposureUnknown;
+
+  /// No description provided for @svcExposurePublicHint.
+  ///
+  /// In en, this message translates to:
+  /// **'This service endpoint sits on a public address — make sure it is protected (TLS, auth, firewall).'**
+  String get svcExposurePublicHint;
+
+  /// No description provided for @svcExposureUnknownHint.
+  ///
+  /// In en, this message translates to:
+  /// **'Hostname instead of an IP address — the hub deliberately does not resolve names to classify.'**
+  String get svcExposureUnknownHint;
+
   /// No description provided for @doctorLinkStore.
   ///
   /// In en, this message translates to:
@@ -4898,6 +4934,84 @@ abstract class AppLocalizations {
   /// **'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.'**
   String get installConfirmTrustBody;
 
+  /// No description provided for @storePolicyUnverifiedNotice.
+  ///
+  /// In en, this message translates to:
+  /// **'Signature enforcement is switched off in the hub policy — installs are not cryptographically verified. The install dialog shows the per-module status; enable security.require_signatures for verified installs.'**
+  String get storePolicyUnverifiedNotice;
+
+  /// No description provided for @verifPillUnverified.
+  ///
+  /// In en, this message translates to:
+  /// **'unsigned'**
+  String get verifPillUnverified;
+
+  /// No description provided for @verifPillBlocked.
+  ///
+  /// In en, this message translates to:
+  /// **'blocked'**
+  String get verifPillBlocked;
+
+  /// No description provided for @verifPinnedKey.
+  ///
+  /// In en, this message translates to:
+  /// **'Signature checked — pinned store key'**
+  String get verifPinnedKey;
+
+  /// No description provided for @verifPinnedKeyBody.
+  ///
+  /// In en, this message translates to:
+  /// **'The hub verifies the bundle at install time against this source\'s pinned key. A tampered bundle is refused.'**
+  String get verifPinnedKeyBody;
+
+  /// No description provided for @verifTrustedPublishers.
+  ///
+  /// In en, this message translates to:
+  /// **'Signature checked — trusted publishers'**
+  String get verifTrustedPublishers;
+
+  /// No description provided for @verifTrustedPublishersBody.
+  ///
+  /// In en, this message translates to:
+  /// **'The hub verifies the signature at install time against the trusted-publisher list. A bundle without a valid signature is refused.'**
+  String get verifTrustedPublishersBody;
+
+  /// No description provided for @verifUnverified.
+  ///
+  /// In en, this message translates to:
+  /// **'Installs without signature checking'**
+  String get verifUnverified;
+
+  /// No description provided for @verifUnverifiedBody.
+  ///
+  /// In en, this message translates to:
+  /// **'Signature enforcement is switched off in the hub policy — this bundle is not cryptographically verified at install time. Enable security.require_signatures for verified installs.'**
+  String get verifUnverifiedBody;
+
+  /// No description provided for @verifBlocked.
+  ///
+  /// In en, this message translates to:
+  /// **'An install would be refused'**
+  String get verifBlocked;
+
+  /// No description provided for @verifBlockedBody.
+  ///
+  /// In en, this message translates to:
+  /// **'The policy requires signatures, but no key material applies to this source — the hub would refuse the install.'**
+  String get verifBlockedBody;
+
+  /// No description provided for @verifFederated.
+  ///
+  /// In en, this message translates to:
+  /// **'Connected via an integration — no bundle signature'**
+  String get verifFederated;
+
+  /// No description provided for @verifFederatedBody.
+  ///
+  /// In en, this message translates to:
+  /// **'This entry is not an installable bundle; it runs through a configured integration (e.g. MCP or n8n). There is no bundle signature — trust follows the integration.'**
+  String get verifFederatedBody;
+
   /// No description provided for @installConfirmSignatureNote.
   ///
   /// In en, this message translates to: