fix(store,doctor): doc-verifier findings on the trust surfaces

The doc-verifier pass over the new trust/exposure surfaces came back
PASS with five improvements, all applied:
- the store policy notice gains a 'Learn more' into the security doc
  (the notice named security.require_signatures but not where it
  lives)
- 'blocked' disables the trust gate's install button — an active
  button contradicted the 'install would be refused' statement right
  above it (guard test added)
- the unknown-exposure tooltip now says what the operator can do
  (check where the name resolves)
- dead l10n key verifPillUnverified removed (unverified is the
  page-level notice, never a card pill)
- stale header comment in install_verification.dart corrected

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/data/install_verification.dart

@@ -2,8 +2,9 @@
 // per-entry statement of how an install would be verified under
 // the CURRENT policy (computed hub-side with the same resolvers
 // the install gate enforces). One mapping, used by the trust-gate
-// dialog, the module detail sheet and the store card, so every
-// surface tells the same story.
+// dialog and the store card's blocked pill, so every surface
+// tells the same story. (The module detail sheet routes installs
+// through the dialog and needs no copy of its own.)
 
 import '../l10n/app_localizations.dart';