feat(packs): support unsigned packs from a static internal registry

[vjeantet]

feat(packs): support unsigned packs from a static internal registry

Closes #1388. Related to #857.

What

Enables air-gapped macOS fleets to distribute and update nono profiles,
Claude Code skills/plugins/hooks, and arbitrary enterprise files from an
internal static (nginx) registry, with signature verification disabled
and integrity guaranteed by per-artifact SHA-256.

This is the lower-friction, integrity-only transport discussed in
#1388 (a complement to the OCI direction of #857, not a replacement).
The keyed ECDSA trust mode is a separate follow-up PR layered on the same
[registry] config.

Changes

• Config: [registry] section (url + verify, fail-secure verify = true by default) and a resolve_registry helper with precedence
  --registry > NONO_REGISTRY > config > default. Verification is turned
  off only via explicit --insecure, NONO_REGISTRY_INSECURE, or
  [registry].verify = false.
• Pull (unsigned tier): when verify is off, skip the Sigstore bundle
  download/verify, namespace assertion, and subject-membership check; keep
  the SHA-256 check. Record an unsigned:internal-registry signer sentinel
  in the lockfile and write no .nono-trust.bundle.
• Runtime guard: verify_profile_packs skips bundle re-verification
  only for packs whose lockfile signer is the sentinel, keyed on the
  lockfile so signed packs always get full re-verification. SHA-256 stays
  enforced.
• Resilience: PullResponse tolerates the minimal static JSON (optional
  provenance; default bundle_url / scan_passed / size_bytes).
• Zero-network posture: suppress registry phone-home (update hints +
  migration provider lookup) when verification is disabled.
• Publish: nono pack publish-static emits the static registry tree
  (versions/<v>/pull, versions/latest/pull, status, files/…) reusing
  the serde types, with latest tracking the highest published semver.
• Docs: air-gapped/internal-registry workflow + GitLab CI example.

Security notes

• The unsigned tier is integrity-only, no provenance, strictly opt-in,
  never the default.
• Fail-secure everywhere: default verify = true; SHA-256 enforced at
  install and at runtime; the lockfile-keyed sentinel guard prevents a
  signed pack from being silently downgraded to integrity-only.
• No change to public-registry or existing keyless signing semantics.

Tests

Unit tests: registry precedence, fail-secure verify resolution, minimal
static JSON deserialization, publish-static generator round-trip, latest
tracking, sentinel runtime guard + tamper detection.

cargo check -p nono-cli and the crate test suite pass locally on macOS.

Stacking

Base branch: feat/static-registry off upstream/main. The keyed-trust PR
is stacked on top of this one and should be reviewed/merged after it.

---

Agent compliance check (AGENTS.md)

• I am not prohibited from contributing under this policy
• An issue already exists — new issue Static internal pack registry (nginx-servable, unsigned integrity tier) #1388 filed; awaiting
  maintainer guidance (see risks section of the issue) before merge
• I described my intent and approach in the issue discussion
• I reviewed repository coding and security rules for the affected area
• I provided required attribution for reused or adapted code (builds on
  existing nono::trust / registry serde types; no external code copied)
• I did not use forbidden patterns such as unwrap/expect
• I used NonoError where required
• I validated and canonicalized all relevant paths
• This PR matches the approved or disclosed issue scope — disclosed;
  not yet approved (issue is a proposal pending maintainer direction)

Note: this contribution is authored with AI assistance. Two checklist
items above are intentionally left unchecked because #857/#1388 is
still a question-labelled proposal. Per AGENTS.md §5/§7 I am not
requesting merge yet — filing for maintainer guidance first.

[github-actions]

PR Review Summary

Size

Metric	Value
Lines added	+1004
Lines removed	-66
Total changed	1070
Classification	Large (> 300 lines)

Affected crates

• crates/nono-cli — CLI changes. Verify argument parsing, flag documentation, and UX behaviour across supported platforms.

Blast radius — Contained

This PR touches: source code

---

_{Updated automatically on each push to this PR.}

[nogent-nolabs-ai]

nogent code review

2 potential bugs bypassing resolve_registry, 1 minor robustness issue in highest_published_version.

Findings (not tied to a changed line):

• 🐛 [MEDIUM · bug] crates/nono-cli/src/package_cmd.rs:515 — In crates/nono-cli/src/package_cmd.rs at lines L515 and L744, the nono update and nono outdated commands rely solely on status.installed_status from the registry response. However, static/internal registries serve flat JSON status files where installed_status is omitted (deserializing to None). In run_update (line L515), None falls into the wildcard match _ and is treated as outdated, triggering redundant /pull HTTP requests for every package even if they are already up-to-date. In run_outdated (line L744), None defaults to "unknown", preventing the command from identifying packages as up-to-date. Fix this by performing a client-side semver comparison (pkg.version == latest) when status.installed_status is None or "unknown".

_{Automated code + security review. CI already covers clippy, rustfmt, tests, cargo-audit and commit-lint.}