trust roots: a manifest-declared policy pack outside policies/** must be a trust root #1075

Deferred by the engineering-review implementation loop from #1074 (issue #1024).

Problem

The trust-root glob table in src/agents_shipgate/core/trust_roots.py:28-58 covers policies/** and the other fixed paths, but a policy pack the manifest declares elsewhere (checks.policy_packs naming, for example, rules/org.yaml) is not a trust root. A PR that edits only that file produces no TRUST-ROOT-TOUCHED finding and can come back mergeable / complete. This is pre-existing on origin/main; #1074 adds trust-root classification for an in-repo --diff-from, --baseline and --policy-pack passed on the command line, but not for packs declared in the manifest.

Evidence

• src/agents_shipgate/core/trust_roots.py:28-58 (glob table).
• Implementer probe during fix(verify): read in-repo --diff-from and ci policy from the base #1074: a PR editing only a manifest-declared pack outside policies/** returned mergeable with no findings. Reproduction steps are held privately by the maintainer, following SECURITY.md.

Proposed fix

Treat every path the manifest binds as policy input (checks.policy_packs, and any other manifest-declared policy or baseline path) as a trust root with class policy, resolved against the base manifest, so a PR cannot un-declare a pack and edit it in the same change. Regression test with a pack outside policies/**. CHANGELOG bullet; STABILITY note for the broadened trust-root set (fingerprints for newly covered paths are new, existing ones must not move).

Acceptance criteria

• A PR editing a manifest-declared pack outside policies/** fires TRUST-ROOT-TOUCHED (class policy) and is not mergeable without human review.
• A PR that removes the declaration and edits the file is judged against the base declaration.
• Goldens and existing fingerprints unchanged.

Source

Engineering review 2026-10-12 follow-up (PR #1074 implementer note). Tracked in #1060.