feat(lighthouse): register trusted manifest signers

routing/public-navigation-anchor.json

@@ -1,7 +1,7 @@
 {
   "schema": "guanghu.public-navigation-anchor/v1",
   "anchor_id": "GLW-PUBLIC-NAV-ANCHOR-001",
-  "version": "2026-08-09.3",
+  "version": "2026-08-09.4",
   "state": "CURRENT_CANONICAL",
   "repository_id": "REPO-012",
   "branch": "main",
@@ -64,6 +64,11 @@
       "path": "skills/codex/guanghu-persona-skill-guard/references/persona-skill-registry.json",
       "id": "GLS-0238",
       "version": "2026.08.07.7"
+    },
+    "trusted_domain_manifest_signers": {
+      "path": "routing/trusted-domain-manifest-signers.json",
+      "id": "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001",
+      "version": "1.0.0"
     }
   },
   "update_contract": {

routing/trusted-domain-manifest-signers.json

@@ -0,0 +1,7 @@
+{
+  "schema": "gh-aios.trusted-domain-manifest-signers/v1",
+  "registryId": "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001",
+  "version": "1.0.0",
+  "state": "CURRENT",
+  "signers": []
+}

routing/trusted-domain-manifest-signers.test.js

@@ -0,0 +1,27 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import test from "node:test";
+import { fileURLToPath } from "node:url";
+
+const directory = path.dirname(fileURLToPath(import.meta.url));
+const registry = JSON.parse(fs.readFileSync(path.join(directory, "trusted-domain-manifest-signers.json"), "utf8"));
+const anchor = JSON.parse(fs.readFileSync(path.join(directory, "public-navigation-anchor.json"), "utf8"));
+
+test("the public trusted-signer registry starts with zero production signers", () => {
+  assert.deepEqual(Object.keys(registry), ["schema", "registryId", "version", "state", "signers"]);
+  assert.equal(registry.schema, "gh-aios.trusted-domain-manifest-signers/v1");
+  assert.equal(registry.registryId, "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001");
+  assert.equal(registry.version, "1.0.0");
+  assert.equal(registry.state, "CURRENT");
+  assert.deepEqual(registry.signers, []);
+  assert.doesNotMatch(JSON.stringify(registry), /PRIVATE KEY|password|token|secret/i);
+});
+
+test("the canonical public anchor declares the exact registry path", () => {
+  assert.deepEqual(anchor.maps.trusted_domain_manifest_signers, {
+    path: "routing/trusted-domain-manifest-signers.json",
+    id: "GH-AIOS-TRUSTED-DOMAIN-MANIFEST-SIGNERS-001",
+    version: "1.0.0"
+  });
+});