truapi-host: honour manifest-declared cross-product trust for local development

[pgherveou]

Part of #517.

Context

The product manifest declares standing grants to other products through trustedProducts, and cross-product flows depend on them: a signing request or a ring-VRF proof requested on behalf of a partner product only works if the grant exists.

For a product that is not deployed there is nothing on chain to resolve, so exactly the flows a partner integration needs cannot be exercised locally. #515 reports the same wall from the host side, for proof contexts across dim2.dot and peopl.dot.

Required behavior and open questions

• The CLI reads trustedProducts from the local manifest config and applies those grants for the duration of the run.
• Cross-product signing and proof requests can be exercised between two locally served products.
• A grant that exists only locally is visible as such in the transcript, so nobody ships assuming it is on chain.
• Decide whether this is a development-mode relaxation or a faithful local implementation of the manifest path, and document the choice.

Related: #515, PR #457.