fix: entryDecisionTrustScore treats explicit packageVerified:false as a positive trust signal

[JSONbored]

Goal

Stop entryDecisionTrustScore from awarding the same trust bonus to an entry explicitly marked packageVerified: false as one marked packageVerified: true.

Why this matters

An explicitly-unverified package is currently scored as if it were trustworthy, which can make it outrank a genuinely safer peer in the compare baseline selection this score feeds into.

Current behavior

apps/web/src/lib/entry-detail-decision-playbook-lib.ts:

• hasPackageSignals (lines 90-94):

  function hasPackageSignals(entry: Pick<Entry, "packageVerified" | "downloadSha256" | "downloadUrl">) {
    return Boolean(entry.packageVerified !== undefined || entry.downloadSha256 || entry.downloadUrl);
  }

• Used at line 106 inside entryDecisionTrustScore: if (hasPackageSignals(entry)) score += 8;
• Because entry.packageVerified !== undefined short-circuits the ||, this returns true whenever packageVerified is set at all — including packageVerified: false — giving the same +8 bonus as packageVerified: true.
• Every other canonical "package trust" helper in the codebase (packageReady in entry-adoption-plan-lib.ts, hasPackage in browse-adoption-queue-lib.ts/compare-mitigation-priority-lib.ts/entry-compare-benchmark-lib.ts, packageTrustCompareSignal in compare-entry-signals-lib.ts) correctly requires packageVerified === true. Even packageChecklist in this same file correctly distinguishes true/false/undefined for its UI checklist item.
• tests/entry-detail-decision-playbook-lib.test.ts covers packageVerified: false for the checklist item but has no test for entryDecisionTrustScore, confirming the scoring path is untested.

Desired behavior

hasPackageSignals (or the trust-score logic that uses it) only awards the package-trust bonus for packageVerified === true, matching every sibling helper's convention. downloadSha256/downloadUrl presence can still independently contribute if that's the intended design — the fix should not conflate "explicitly unverified" with "has some package signal."

Scope

• apps/web/src/lib/entry-detail-decision-playbook-lib.ts (hasPackageSignals, entryDecisionTrustScore)
• focused tests

Out of scope

• packageChecklist (already correct)
• Other files' hasPackage/packageReady helpers (already correct, reference only)

Acceptance criteria

• PR includes Closes #<issue>.
• An entry with packageVerified: false and no other package signals no longer receives the +8 trust bonus.
• An entry with packageVerified: true still receives it.
• A new test covers entryDecisionTrustScore for packageVerified: false explicitly.

Quality evidence required in the PR

• No visual impact; include the exact scoring delta for a packageVerified: false entry before/after.

Validation

pnpm build
pnpm exec vitest run tests/entry-detail-decision-playbook-lib.test.ts
git diff --check

[linear-code]

JSO-7318