fix(store,doctor): doc-verifier findings on the trust surfaces

The doc-verifier pass over the new trust/exposure surfaces came back
PASS with five improvements, all applied:
- the store policy notice gains a 'Learn more' into the security doc
  (the notice named security.require_signatures but not where it
  lives)
- 'blocked' disables the trust gate's install button — an active
  button contradicted the 'install would be refused' statement right
  above it (guard test added)
- the unknown-exposure tooltip now says what the operator can do
  (check where the name resolves)
- dead l10n key verifPillUnverified removed (unverified is the
  page-level notice, never a card pill)
- stale header comment in install_verification.dart corrected

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -1218,7 +1218,7 @@
   "svcExposurePublic": "publicly reachable",
   "svcExposureUnknown": "reach unknown",
   "svcExposurePublicHint": "This service endpoint sits on a public address — make sure it is protected (TLS, auth, firewall).",
-  "svcExposureUnknownHint": "Hostname instead of an IP address — the hub deliberately does not resolve names to classify.",
+  "svcExposureUnknownHint": "Hostname instead of an IP address — the hub deliberately does not resolve names to classify. Check yourself where the name resolves.",
   "doctorLinkStore": "Open the store",
   "doctorLinkApprovals": "Open approvals",
   "doctorLinkAudit": "Open the audit log",
@@ -1653,7 +1653,6 @@
   "installConfirmTrustTitle": "Trust & security",
   "installConfirmTrustBody": "The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.",
   "storePolicyUnverifiedNotice": "Signature enforcement is switched off in the hub policy — installs are not cryptographically verified. The install dialog shows the per-module status; enable security.require_signatures for verified installs.",
-  "verifPillUnverified": "unsigned",
   "verifPillBlocked": "blocked",
   "verifPinnedKey": "Signature checked — pinned store key",
   "verifPinnedKeyBody": "The hub verifies the bundle at install time against this source's pinned key. A tampered bundle is refused.",