Display recorded trust state to the user

[samuv]

Note

Stack 2 of RFC THV-0080 (tracking issue #5899) — part of stack #6128, on top of #6132. This is the display follow-up promised in #6129's review.

Summary

RFC THV-0080 requires the identity pinned at trust-on-first-use to be "displayed prominently" — today the user first meets it weeks later inside a signer-mismatch 403. This PR surfaces the recorded trust state everywhere it's decided or queried:

• ProvenanceInfo becomes API-visible (signer_identity, cert_issuer, repository_uri, sigstore_url, provisional) instead of json:"-" end to end.
• Install results carry the decision just recorded: the response includes provenance or unsigned, and the CLI prints it — Installed <name> (signed by <identity>), the provisional variant, or the explicit-unsigned variant.
• thv skill info shows the lock file's recorded trust state for project-scoped, lock-managed skills (Signed by: / Cert issuer: / unsigned-exception lines, JSON included).

Type of change

• New feature (non-breaking change which adds functionality)

Test plan

• Unit tests pass locally
• Linting passes (task lint-fix, 0 issues)
• Existing verification tests cover the decision plumbing the display reads (installAndRegister now surfaces it on the result); task docs regenerated (swagger for the new response fields).

Does this introduce a user-facing change?

Yes, behind the experimental gate: successful project-scoped installs print the recorded trust state, and thv skill info shows the pinned signer identity.

Special notes for reviewers

• The install success line is a deliberate exception to the CLI "silent success" rule (.claude/rules/cli-commands.md): a freshly pinned trust anchor is security-relevant information the RFC requires to be visible, not progress chatter. Happy to gate it differently if you disagree.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.46%. Comparing base (8cb954f) to head (baa3b8a).

Additional details and impacted files

@@                       Coverage Diff                       @@
##           skills-sig/13-upgrade-guard    #6137      +/-   ##
===============================================================
- Coverage                        72.47%   72.46%   -0.02%     
===============================================================
  Files                              740      739       -1     
  Lines                            76358    76319      -39     
===============================================================
- Hits                             55344    55306      -38     
+ Misses                           17083    17074       -9     
- Partials                          3931     3939       +8     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.