Public proof page /proof/:owner/:repo + README badge — the shareable verification surface

[JSONbored]

Context

The verification stack is live — public ledger-verify, external anchor with chain hash, digest-stable published decision records — and #9193 renders it as the in-app per-repo trust panel. This issue is the public twin: an unauthenticated, shareable per-repo proof page plus a README badge linking to it. Maintainer trust becomes distribution: every proof page markets a capability competitors without a verifiable ledger cannot ship. The public repo-quality page and badge endpoints are the existing pattern to follow (apps/loopover-ui/src/routes/repos.$owner.$repo.quality.tsx, the public badge routes).

Requirements

1. /proof/:owner/:repo public page: decisions count, calibration — always with coverage and confidence interval, never a bare scalar — live ledger-verify status (real call, not cached decoration), latest external-anchor reference, and sample published decision records. Styled with the receipt/evidence treatment from the design-language issue.
2. README badge: an SVG badge endpoint linking to the proof page; cache-safe.
3. One implementation, two renderings: identical figures and sources as the in-app trust panel (orb(dashboard): per-repo trust panel — ledger verify, anchor, decision records, calibration with coverage, attestation states #9193); every figure links to its public artifact so the number can be independently re-derived.
4. Privacy boundary: published/public data only; no wallet, hotkey, reward, trust-score, or private-ranking data anywhere.
5. Honest boundary states: not-yet-anchored and no-published-records render as neutral states, not errors; the "not verifiable" boundary is stated in the verification contract's language.
6. Decide and record: whether a maintainer can opt a repo out of the public proof page, and the default.

Boundaries

• Read-only over existing public endpoints — no new verification mechanisms or data paths.
• Feature-flagged off by default, matching the epic's siblings.

References

Relates to #9193 (in-app twin), #9183, #4935 (public status page), and the design-language issue.

[linear-code]

JSO-6610