GHSA-hc4m-q9jh-xw4j: nono-cli'scregistry pack verification can fail open when provenance metadata is absent

Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant:

• ~/.config/nono/packages/lockfile.json
• ~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle

Testing shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.