Display recorded trust state to the user

[samuv]

Note

Stack 2 of RFC THV-0080 (tracking issue #5899) — part of stack #6128, on top of #6132. This is the display follow-up promised in #6129's review.

Summary

RFC THV-0080 requires the identity pinned at trust-on-first-use to be "displayed prominently" — today the user first meets it weeks later inside a signer-mismatch 403. This PR surfaces the recorded trust state everywhere it's decided or queried:

• ProvenanceInfo becomes API-visible (signer_identity, cert_issuer, repository_uri, sigstore_url, provisional) instead of json:"-" end to end.
• Install results carry the decision just recorded: the response includes provenance or unsigned, and the CLI prints it — Installed <name> (signed by <identity>), the provisional variant, or the explicit-unsigned variant.
• thv skill info shows the lock file's recorded trust state for project-scoped, lock-managed skills (Signed by: / Cert issuer: / unsigned-exception lines, JSON included).

Type of change

• New feature (non-breaking change which adds functionality)

Test plan

• Unit tests pass locally
• Linting passes (task lint-fix, 0 issues)
• Existing verification tests cover the decision plumbing the display reads (installAndRegister now surfaces it on the result); task docs regenerated (swagger for the new response fields).

Does this introduce a user-facing change?

Yes, behind the experimental gate: successful project-scoped installs print the recorded trust state, and thv skill info shows the pinned signer identity.

Special notes for reviewers

• The install success line is a deliberate exception to the CLI "silent success" rule (.claude/rules/cli-commands.md): a freshly pinned trust anchor is security-relevant information the RFC requires to be visible, not progress chatter. Happy to gate it differently if you disagree.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.81%. Comparing base (c86cb8a) to head (b391771).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6137      +/-   ##
==========================================
- Coverage   72.84%   72.81%   -0.03%     
==========================================
  Files         743      743              
  Lines       77649    77674      +25     
==========================================
- Hits        56563    56558       -5     
- Misses      17119    17146      +27     
- Partials     3967     3970       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[samuv]

Rebased onto main and marked ready. Two things changed since this was drafted.

Conflict resolution. The conflict in cmd/thv/app/skill_install.go came from #6223, which added an absProjectRoot call to the same function. Both changes are kept.

A defect this PR shipped with, now fixed. The install half of this feature never worked. InstallResult.Provenance / .Unsigned were populated server-side, but neither installSkillResponse nor the client's installResponse carried them, and Client.Install returned &skills.InstallResult{Skill: resp.Skill} — dropping both. Since the CLI is a pure HTTP client, printInstallTrust always fell through to the bare Installed <name> no matter what was verified.

The skill info path was fine — it decodes straight into skills.SkillInfo, which is fully tagged.

Fixed by wiring both fields across all four hops, plus TestInstallCarriesTrustStateBackToCaller, a table over signed / provisional / unsigned / neither. I verified it actually catches the regression by reverting the client mapping and watching it fail, rather than assuming:

--- FAIL: TestInstallCarriesTrustStateBackToCaller/signed_install_reports_the_pinned_identity
    Messages: provenance must survive the HTTP boundary — the CLI has no other source for it

Worth noting the failure mode, since it is the same shape as the --allow-unsigned gap fixed earlier in this stack: a unit test of the printer passes either way, so only a round-trip test over the wire catches it.

task test, task lint-fix, and task docs all green at the branch tip.