Prevent authentication service capability downgrades

Co-Authored-By: GPT-5.6-Sol <noreply@openai.com>

test/shell.d/fixtures/plugin-auth-boundary/AuthStoreOwner.qml

@@ -10,6 +10,10 @@ QtObject {
     return AuthServiceStore.has(id)
   }
 
+  function isTrusted(id) {
+    return AuthServiceStore.isTrusted(id)
+  }
+
   function updateManifest(id, manifest) {
     AuthServiceStore.updateManifest(id, manifest)
   }

test/shell.d/fixtures/plugin-auth-boundary/shell.qml

@@ -75,6 +75,7 @@ ShellRoot {
       ownSettings: api.updateEntryInline(caller, {}) === true,
       foreignSettings: api.updateEntryInline("omarchy.lock", {}) === false,
       authStoreOwnerRetains: authStoreOwner.has("omarchy.lock") === true,
+      authStoreOwnerRemembersTrust: authStoreOwner.isTrusted("omarchy.lock") === true,
       authStoreOwnerUpdatesManifest: root.ownService.manifest
         && root.ownService.manifest.version === "kept",
       authStoreImportIsolated: authStoreReader.has("omarchy.lock") === false,