feat(licensing): vendor ML-DSA-65 trust anchor + PLANS_TODO entry for shell hardening (#2042, #1926)

[FabioLeitao]

Summary

• licensing: âncora ML-DSA embutida ausente e híbrido ainda opcional no guard (canon: Ed25519 + ML-DSA obrigatório) #2042 (partial, no behavior change): vendors the ML-DSA-65 public trust anchor as core/licensing/license-mldsa-pub-v1.pem, the file trust_anchor.EMBEDDED_MLDSA_ANCHOR_RESOURCE already expects and that was missing. It is byte-identical to the canonical keen-platypus/go/kp-license-check/trust/golden-mldsa.pub (sha256 37faef8ff167cf01a0fc6a2bc8b7cfcac6bfe5651360051b1eb00a0a60fa85b8, 2717 bytes). It is shipped in the wheel (force-include) and allowed in .gitignore the same way as license-pub-v1.pem. A test pins the hash and checks that the key loads as ML-DSA-65 and that no private block is present.
• Hybrid verification stays optional. core/licensing/*.py is not touched: a token without dbmldsa_sig still verifies with Ed25519 only, and a test pins that. Making the hybrid mandatory, the re-issue path and the dev-issuer test anchor (licensing: emissor de licença de dev (issue_dev_license_jwt.py) não emite ML-DSA — quebra o Maestro quando o híbrido for obrigatório #2043) are left for the operator's decision.
• chore: shellcheck em CI + bats hermético seletivo pros 65 scripts bash do repo (zero cobertura hoje) #1926: adds the missing docs/plans/PLANS_TODO.md entry for the shell hardening plan. It was the last open acceptance line: shellcheck (severity=error) already runs in check-all and in ci.yml, and the plan, the 73-file inventory and the hub sync are already on main.

Gate files

No file under .github/workflows/ and none of the tripwire gate files is touched, so no Gate-Change-Approved-By is needed.

Verification

• ./scripts/check-all.sh exited 0 on this branch after the last commit (pre-commit, pytest, security scans).
• Fail then pass: with the PEM renamed, test_committed_mldsa_anchor_pem_matches_canonical_sha256 fails with missing packaged anchor PEM in source tree; restored, the 6 tests pass.
• Packaging: built the wheel (uv build --wheel, 1.8.0rc0) and listed it: it contains core/licensing/license-mldsa-pub-v1.pem (2717 bytes, sha256 37faef8f…, no PRIVATE) next to license-pub-v1.pem.
• Windows: the canonical sha256 is of LF bytes, so the test normalises CRLF to LF before hashing; .gitattributes is untouched.

Not verified

• Other distribution channels: only the wheel was inspected. I found no reference to the Ed25519 PEM in a Dockerfile, MANIFEST.in or a hash manifest to mirror, so none was changed.
• End-to-end hybrid token with this anchor: needs a token signed by the operator's golden ML-DSA private key, which is deliberately not available here. The embedded key is verified by hash and by loading, not by verifying a production token.

Closing

Closes #1926
Refs #2042
Refs #1462
Refs #2055
Refs #2021

🤖 Generated with Claude Code

https://claude.ai/code/session_0142QEjA7eEFcdXTpcTmcAZk