docs(scanner): add signed manifest reporting examples

[marmar9615-cloud]

Summary

Adds scanner signed-manifest reporting examples and regression coverage now that scanner check IDs have landed.

Context

• v0.4.0 is published/released.
• Builds on predecessor work:
  • feat(core): add signed manifest verifier #39 core verifyManifestSignature() + test vectors
  • test(examples): verify signed manifest example #40 verifier-backed signed-manifest example checks
  • feat(scanner): add signed manifest checks #41 scanner signed-manifest check IDs
• Claude may be working on CLI signature commands (validate --require-signature, agentbridge verify, key generation), so this PR avoids CLI runtime/test files.

Why this is parallel-safe

This PR is limited to scanner docs/tests, examples, and the examples validation script. It does not touch CLI command implementation, core signing/verifier implementation, specs, or MCP runtime code.

Files added

• examples/scanner-signature-reporting/README.md
• examples/scanner-signature-reporting/reporting.ts
• packages/scanner/src/tests/signature-reporting-example.test.ts

Files modified

• CHANGELOG.md
• examples/README.md
• packages/scanner/README.md
• scripts/validate-examples.mjs

Report/check IDs demonstrated

The reporting example covers:

• unsigned default scan/report: no signature check IDs
• unsigned with requireSignature: manifest.signature.missing
• valid signed manifest with public key set: manifest.signature.verified
• tampered signed manifest with public key set: manifest.signature.invalid
• expired signed manifest with public key set: manifest.signature.expired

Commands run

• npx vitest run packages/scanner/src/tests — passed, 4 files / 46 tests
• npm run typecheck:clean — passed
• npm test — passed, 26 files / 412 tests
• npm run build — passed
• npm run pack:dry-run — passed, all packages OK
• npm run validate:examples — passed, including scanner signature reporting check IDs
• npm run validate:mcp-config-examples — passed
• npx tsx examples/scanner-signature-reporting/reporting.ts — passed live reporting smoke

Live scanner/reporting smoke

npx tsx examples/scanner-signature-reporting/reporting.ts emitted the expected scenario IDs:

• unsigned-default: []
• unsigned-require-signature: manifest.signature.missing
• signed-valid-key-set: manifest.signature.verified
• signed-tampered-key-set: manifest.signature.invalid
• signed-expired-key-set: manifest.signature.expired

The output is a compact report only; it does not print full manifests, key sets, signature bytes, or private key material.

Browser/computer-use status

No UI/browser surface changed. This is scanner/docs/examples coverage, so command-level scanner/reporting smoke was the appropriate validation.

Confirmations

• No CLI runtime files touched (packages/cli/src/* avoided).
• No CLI README touched.
• No core implementation files touched (packages/core/src/* avoided).
• No spec files touched.
• No MCP runtime files touched (apps/mcp-server/src/* avoided).
• No package versions changed.
• No package-lock.json changes.
• No npm publish, git tag, or GitHub release.
• Dependabot PRs untouched.
• No CLI enforcement implemented.
• No MCP enforcement implemented.