S5: catalog trust — direnv-style trust for project .relix/ directories #9

Part of #17. Design: docs/design.md §5.4.

Scope

A project catalog can declare a connection or HTTP source that sends ${SECRET} values to a host of its author's choosing, so a project .relix/ is loaded only once the user has trusted it, as direnv does.

• Trusted without asking: ~/.relix, a script named on the command line, -e, stdin, and --catalog files. The user chose those.
• relix catalog trust [DIR] records a hash of the directory's files in ~/.relix/trusted. Changing, adding or removing a file means trusting it again.
• --list and --revoke DIR manage the record.
• An untrusted level is skipped with one stderr line naming the command to run. If the script then needs a name that level would have supplied, the run exits 5.
• RELIX_TRUST_ALL=1 trusts everything, for CI containers.

Dependencies

• S4 (S4: catalog discovery — .relix/ directories up the hierarchy, nearest-wins overlay #8). Ship together with or before S4's release.

Acceptance

• An untrusted level is not defined at all: a test proves its connection is never opened.
• Trusting, then editing a file, makes it untrusted again.
• Revoking works.
• RELIX_TRUST_ALL works.
• The exit-5 path is tested.