refactor(store): move trust org domain into module

[freezscholte]

Summary

• move trust policy, enforcement, trust-rank helpers, local key status/rotation, hosted-runner/third-party attestation policy, and org governance status/init code into crates/forge-store/src/trust.rs
• preserve the existing store public API through lib.rs re-exports
• keep Ed25519 mechanics in existing signing.rs; trust.rs only orchestrates policy/status/attestation behavior
• keep needed sibling-module helpers crate-private for private overlay, embargo, publication, and review code still awaiting later slices
• lower the store lib.rs line-count cap from 10,460 to 9,600 and update ADR-0001 with the NER-375 audit note

Verification

• rtk cargo check -p forge-store
• rtk cargo test -p forge-cli --test forge_trust_policy
• rtk cargo test -p forge-cli --test forge_org_identity
• rtk cargo test -p forge-cli --test forge_encrypted_private_content
• rtk cargo test -p forge-cli --test forge_visibility
• scripts/check-rust-line-count.sh
• rtk cargo fmt --all --check
• rtk cargo test --workspace — 603 passed across 61 suites
• rtk cargo clippy --workspace --all-targets -- -D warnings
• rtk bash scripts/ci.sh — PASS=95 FAIL=0

Fixes NER-375.
Related NER-371.

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}