fix: reshape skill verify security signals

[Patrick-Erichsen]

Summary

• Flatten clawhub skill verify envelope metadata so skill, publisher, and selected version fields are top-level.
• Move ClawScan verdict fields to security.* and scanner evidence to security.signals.*.
• Document the verify endpoint shape and update the durable security/moderation intent note.

Tests

• bunx vitest run -c vitest.config.ts convex/httpApiV1.handlers.test.ts --testNamePattern "verification|Skill Card"
• bun run --cwd packages/clawhub test:src -- src/cli/commands/inspect.test.ts src/schema/schemas.test.ts
• bunx vitest run -c vitest.config.ts packages/schema/src/schemas.test.ts
• bun run ci:packages
• bunx tsc --noEmit
• bunx tsc -p packages/schema/tsconfig.json --noEmit
• bunx tsc -p packages/clawhub/tsconfig.json --noEmit
• bun run ci:static

Notes

• Autoreview did not produce a clean marker locally because Codex review crashed or spawned nested review processes; fallback Claude had low credit and Droid was unauthenticated.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview, Comment	May 26, 2026 1:45am

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: fix: reshape skill verify security signals This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.