Never report governance posture clear before its evidence is verified

Problem/Motivation

The local governance dashboard can currently present an overall clear state while audit-chain verification is still reported as not yet verified. That is a false-assurance state: an operator can read the summary as proof that governance posture is healthy before the evidence supporting that claim has been verified.

Steps to reproduce

1. Install and configure MCP Sentinel with audit evidence present.
2. Open the local governance dashboard before the audit chain has completed a successful verification.
3. Observe that the overall summary may report a clear state while chain verification remains not yet verified.

Proposed resolution

Make the dashboard state machine evidence-aware. An overall clear state must require successful verification of every evidence source that the summary depends on. Unknown, pending, stale, degraded, failed, and unavailable evidence must remain distinct and visible.

Acceptance criteria

• The dashboard never reports an overall clear state while required evidence is unverified, pending, stale, unavailable, or failed.
• A not-yet-verified chain produces a stable non-clear state with an actionable, non-secret explanation.
• Successful verification can move the summary to clear only when every other required posture input is also clear.
• A previously verified chain that becomes stale or fails verification immediately returns the summary to a non-clear state.
• The dashboard distinguishes unknown, pending, stale, degraded, failed, and verified states.
• The summary links to the evidence details used to compute it without becoming an authorization authority.
• Tests cover first-run verification, successful verification, stale evidence, verification failure, unavailable evidence, and recovery.

Scope boundary

This issue fixes the truthful-state behavior of the existing local dashboard. A separate hosted or estate-wide visualization may consume this contract after it is complete.

User interface changes

The dashboard summary gains explicit non-clear states for evidence that is unknown, pending, stale, degraded, failed, or unavailable.

API changes

No public API change is required unless the current dashboard state provider cannot express the truthful state model.

Data model changes

None expected.