fix(#59/JG-RT-026): pin Action Manifest verifier key out-of-band

[tattoosonmyskin]

Internal red-team (#59) of the freshly-merged Action Manifest (#62) found a key-trust gap.

Finding (JG-RT-026, MED)

--verify-manifests read the trusted Ed25519 public key from <audit-log>.manifests.pub — a file in the same directory as the log it verifies. An attacker who can rewrite the log can also rewrite that pubkey: regenerate self-consistent manifests signed with their own key, publish that key, and the verifier reports OK. That silently defeats the non-repudiation the manifests exist to provide. (The original forgery_with_different_key… test only passed because it manually restored the genuine pubkey, masking the gap.)

Fix

• verify_manifests() takes an optional pinned key; CLI adds --manifest-pubkey <hex> (out-of-band).
• Pinned → in-dir pubkey ignored, authenticity checked against the pinned key (the only mode resisting a malicious log-holder).
• Unpinned → convenience fallback to the in-dir key (accidental-corruption detection only); result flagged pubkey_pinned=false and reported as "self-consistency only," never mistakable for authenticity.

Validation

• New regression test swapped_pubkey_forgery_defeated_only_by_pinned_key (8 manifest tests total); full ts_cli suite green; fmt + clippy clean.
• End-to-end: unpinned → OK "key NOT pinned"; pinned-genuine → OK "authentic"; pinned-wrong → authenticity FAIL exit 70.
• Docs: THREAT_MODEL §12.1 (key-distribution rule), RED_TEAM_FINDINGS.md JG-RT-026, CHANGELOG.

🤖 Generated with Claude Code