feat(store,doctor): surface the hub's trust + exposure data (0.77.0)

The trust-gate dialog replaces its generic 'no per-entry status yet
(alpha)' note with the hub's classified verification statement —
pinned store key / trusted publishers (green), installs without
signature checking (amber), install would be refused (red), bridge
entry (neutral) — via one shared describeInstallVerification mapping.
Against a pre-0.23 hub the field is empty and the old honest wording
stays (pinned by test).

Information architecture: policy-off is a GLOBAL fact, so it appears
as ONE ChainInlineHelp notice above the store grid instead of a
warning pill on every card (card noise); only 'blocked' — a genuine
per-source anomaly — earns a card pill. Doctor's host services show
the hub-classified network reach per endpoint (local only / private
network / publicly reachable with a protect-it hint / reach unknown).

Verified end-to-end against the live dev hub (guide harness): the
wire field arrives, the store page shows exactly one policy notice
and quiet cards; trust-gate variants captured via the dialog
harness. Suite 123 green.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations_en.dart

@@ -2153,6 +2153,26 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get doctorSummaryDeclared => 'declared';
 
+  @override
+  String get svcExposureLoopback => 'local only';
+
+  @override
+  String get svcExposurePrivate => 'private network';
+
+  @override
+  String get svcExposurePublic => 'publicly reachable';
+
+  @override
+  String get svcExposureUnknown => 'reach unknown';
+
+  @override
+  String get svcExposurePublicHint =>
+      'This service endpoint sits on a public address — make sure it is protected (TLS, auth, firewall).';
+
+  @override
+  String get svcExposureUnknownHint =>
+      'Hostname instead of an IP address — the hub deliberately does not resolve names to classify.';
+
   @override
   String get doctorLinkStore => 'Open the store';
 
@@ -2882,6 +2902,52 @@ class AppLocalizationsEn extends AppLocalizations {
   String get installConfirmTrustBody =>
       'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.';
 
+  @override
+  String get storePolicyUnverifiedNotice =>
+      'Signature enforcement is switched off in the hub policy — installs are not cryptographically verified. The install dialog shows the per-module status; enable security.require_signatures for verified installs.';
+
+  @override
+  String get verifPillUnverified => 'unsigned';
+
+  @override
+  String get verifPillBlocked => 'blocked';
+
+  @override
+  String get verifPinnedKey => 'Signature checked — pinned store key';
+
+  @override
+  String get verifPinnedKeyBody =>
+      'The hub verifies the bundle at install time against this source\'s pinned key. A tampered bundle is refused.';
+
+  @override
+  String get verifTrustedPublishers => 'Signature checked — trusted publishers';
+
+  @override
+  String get verifTrustedPublishersBody =>
+      'The hub verifies the signature at install time against the trusted-publisher list. A bundle without a valid signature is refused.';
+
+  @override
+  String get verifUnverified => 'Installs without signature checking';
+
+  @override
+  String get verifUnverifiedBody =>
+      'Signature enforcement is switched off in the hub policy — this bundle is not cryptographically verified at install time. Enable security.require_signatures for verified installs.';
+
+  @override
+  String get verifBlocked => 'An install would be refused';
+
+  @override
+  String get verifBlockedBody =>
+      'The policy requires signatures, but no key material applies to this source — the hub would refuse the install.';
+
+  @override
+  String get verifFederated =>
+      'Connected via an integration — no bundle signature';
+
+  @override
+  String get verifFederatedBody =>
+      'This entry is not an installable bundle; it runs through a configured integration (e.g. MCP or n8n). There is no bundle signature — trust follows the integration.';
+
   @override
   String get installConfirmSignatureNote =>
       'The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).';