* refactor: replace hashesValid with packageValid
Update QVariantMap field names and documentation to match upstream
package_valid rename in SignatureVerificationResult.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat: replace TOFU with explicit keyring management API
Remove setTofuEnabled and add addTrustedKey, removeTrustedKey, and
listTrustedKeys methods that call the lgx C API directly. This gives
the UI/app explicit control over trust decisions.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: address PR review feedback
- Warn on invalid signature policy values instead of silently ignoring
- Distinguish signature verification errors from unsigned packages
- Document optional fields in installPlugin response
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* bump dependencies
* Add tests
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
