ADR-013 Phase 2: enforcement + signed shelf + adopt

Completes the marketplace security model. Verification stops being advisory:
a plugin only loads or migrates when its tree matches a trusted signature, and
plugins are pulled from a signed shelf with anti-rollback and revocation.

Enforcement (default OFF - existing deploys unchanged):
- verification.py PluginVerifier, shared by the loader (verify-at-load, before
  plugin.py is imported) and the migration manager (verify-at-migrate, before
  any DDL). Fail-closed: an unsigned/tampered/wrong-key plugin does not run.
- Gated by PLUGIN_REQUIRE_SIGNED. PLUGIN_DEV_TRUST_DIRS exempts named dirs but
  only under DEBUG/TESTING; production ignores it.
- flask plugin stamp-bundled writes provenance into in-tree plugins so
  verify-at-load applies to bundled plugins too (image build step).
- tier:core manifest guard: uninstall/disable refuse a core-tier plugin.

Shelf (shelf.py):
- Signed shelf-index.json (+ .sig): monotonic serial (a site refuses an older
  index - anti-rollback), revoked list carried across builds, per-entry
  version/tier/core_version for browse. Index is a browse layer only; adopt
  reads security-bearing fields from the verified artifact.
- flask plugin shelf-build / shelf-list / adopt / audit. adopt verifies index +
  artifact (signature + every file hash), unpacks to staging, re-verifies, then
  atomically moves into place and installs+enables the closure. Refuses a
  downgrade without --force-downgrade. Anti-rollback serial stored in
  instance/shelf-state.json.
- config PLUGIN_SHELF_DIR; the app only reads the folder, never speaks a
  network. .env.example + docs/PLUGIN-SIGNING.md document the flow.

22 tests: verifier policy (off / no-keys / signed / tampered / wrong-key /
dev-exempt), verify-at-load + verify-at-migrate integration, tier guard, index
sign/verify + tamper/wrong-key, serial state, revocation, version resolution,
verified atomic unpack + tamper refusal. Live-smoked keygen->pack->shelf-build
->list->adopt->audit + serial guard. 1050 pass, naming green.

shopdb/config.py

@@ -70,6 +70,25 @@ class Config:
         if path.strip()
     ]
 
+    # When true, a plugin only loads/migrates if its tree matches a trusted
+    # signature (verify-at-load, verify-at-migrate). Default false = existing
+    # behavior. Turn on only after stamping plugins + pinning keys.
+    PLUGIN_REQUIRE_SIGNED = os.environ.get(
+        'PLUGIN_REQUIRE_SIGNED', 'false').lower() == 'true'
+
+    # Directories whose unsigned plugins are trusted - honored ONLY under
+    # DEBUG/TESTING (the external-repo/symlink dev workflow). Production ignores.
+    PLUGIN_DEV_TRUST_DIRS = [
+        path.strip()
+        for path in os.environ.get('PLUGIN_DEV_TRUST_DIRS', '').split(os.pathsep)
+        if path.strip()
+    ]
+
+    # Read-only folder the app pulls plugin artifacts from (a SharePoint-synced
+    # or copied shelf). Empty = no shelf configured. The app never speaks any
+    # network protocol; it reads this folder.
+    PLUGIN_SHELF_DIR = os.environ.get('PLUGIN_SHELF_DIR', '')
+
     ZABBIX_ENABLED = os.environ.get('ZABBIX_ENABLED', 'false').lower() == 'true'
     ZABBIX_URL = os.environ.get('ZABBIX_URL', '')
     ZABBIX_TOKEN = os.environ.get('ZABBIX_TOKEN', '')