ADR-013 Phase 2: enforcement + signed shelf + adopt

Completes the marketplace security model. Verification stops being advisory:
a plugin only loads or migrates when its tree matches a trusted signature, and
plugins are pulled from a signed shelf with anti-rollback and revocation.

Enforcement (default OFF - existing deploys unchanged):
- verification.py PluginVerifier, shared by the loader (verify-at-load, before
  plugin.py is imported) and the migration manager (verify-at-migrate, before
  any DDL). Fail-closed: an unsigned/tampered/wrong-key plugin does not run.
- Gated by PLUGIN_REQUIRE_SIGNED. PLUGIN_DEV_TRUST_DIRS exempts named dirs but
  only under DEBUG/TESTING; production ignores it.
- flask plugin stamp-bundled writes provenance into in-tree plugins so
  verify-at-load applies to bundled plugins too (image build step).
- tier:core manifest guard: uninstall/disable refuse a core-tier plugin.

Shelf (shelf.py):
- Signed shelf-index.json (+ .sig): monotonic serial (a site refuses an older
  index - anti-rollback), revoked list carried across builds, per-entry
  version/tier/core_version for browse. Index is a browse layer only; adopt
  reads security-bearing fields from the verified artifact.
- flask plugin shelf-build / shelf-list / adopt / audit. adopt verifies index +
  artifact (signature + every file hash), unpacks to staging, re-verifies, then
  atomically moves into place and installs+enables the closure. Refuses a
  downgrade without --force-downgrade. Anti-rollback serial stored in
  instance/shelf-state.json.
- config PLUGIN_SHELF_DIR; the app only reads the folder, never speaks a
  network. .env.example + docs/PLUGIN-SIGNING.md document the flow.

22 tests: verifier policy (off / no-keys / signed / tampered / wrong-key /
dev-exempt), verify-at-load + verify-at-migrate integration, tier guard, index
sign/verify + tamper/wrong-key, serial state, revocation, version resolution,
verified atomic unpack + tamper refusal. Live-smoked keygen->pack->shelf-build
->list->adopt->audit + serial guard. 1050 pass, naming green.

shopdb/plugins/migrations.py

@@ -18,6 +18,8 @@ class PluginMigrationManager:
     def __init__(self, plugins_dir: Path, database_url: str):
         self.plugins_dir = plugins_dir
         self.database_url = database_url
+        # Set by PluginManager.init_app; a PluginVerifier or None (no policy).
+        self.verifier = None
 
     def get_migrations_dir(self, plugin_name: str) -> Optional[Path]:
         """Get migrations directory for a plugin."""
@@ -36,6 +38,16 @@ class PluginMigrationManager:
 
         Uses flask db upgrade with the plugin's migrations directory.
         """
+        # verify-at-migrate: never run a plugin's DDL (full DB rights) from an
+        # unverified tree when the site enforces signing.
+        if self.verifier is not None:
+            ok, reason = self.verifier.check(plugin_name)
+            if not ok:
+                logger.error(
+                    "Refusing migrations for %s: signature verification failed "
+                    "(%s)", plugin_name, reason)
+                return False
+
         migrations_dir = self.get_migrations_dir(plugin_name)
 
         if not migrations_dir: