Display recorded trust state to the user

[samuv]

Note

Stack 2 of RFC THV-0080 (tracking issue #5899) — part of stack #6128, on top of #6132. This is the display follow-up promised in #6129's review.

Summary

RFC THV-0080 requires the identity pinned at trust-on-first-use to be "displayed prominently" — today the user first meets it weeks later inside a signer-mismatch 403. This PR surfaces the recorded trust state everywhere it's decided or queried:

• ProvenanceInfo becomes API-visible (signer_identity, cert_issuer, repository_uri, sigstore_url, provisional) instead of json:"-" end to end.
• Install results carry the decision just recorded: the response includes provenance or unsigned, and the CLI prints it — Installed <name> (signed by <identity>), the provisional variant, or the explicit-unsigned variant.
• thv skill info shows the lock file's recorded trust state for project-scoped, lock-managed skills (Signed by: / Cert issuer: / unsigned-exception lines, JSON included).

Type of change

• New feature (non-breaking change which adds functionality)

Test plan

• Unit tests pass locally
• Linting passes (task lint-fix, 0 issues)
• Existing verification tests cover the decision plumbing the display reads (installAndRegister now surfaces it on the result); task docs regenerated (swagger for the new response fields).

Does this introduce a user-facing change?

Yes, behind the experimental gate: successful project-scoped installs print the recorded trust state, and thv skill info shows the pinned signer identity.

Special notes for reviewers

• The install success line is a deliberate exception to the CLI "silent success" rule (.claude/rules/cli-commands.md): a freshly pinned trust anchor is security-relevant information the RFC requires to be visible, not progress chatter. Happy to gate it differently if you disagree.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.57%. Comparing base (948d28c) to head (6a65d43).

Additional details and impacted files

@@                       Coverage Diff                       @@
##           skills-sig/13-upgrade-guard    #6137      +/-   ##
===============================================================
+ Coverage                        72.53%   72.57%   +0.03%     
===============================================================
  Files                              736      736              
  Lines                            76624    76641      +17     
===============================================================
+ Hits                             55582    55620      +38     
+ Misses                           17068    17050      -18     
+ Partials                          3974     3971       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.