feat(cloud-facts): pin the first production trust anchor

Both trust tables were empty, which made the entire cloud-facts layer inert:
with no active key `ticket()` returns `RefreshError::Inert`, so `refresh` and
`maybe_load_persisted_cache` bail before reading anything, and `configure()`
publishes `CloudFactsState::Inert`. Nothing downstream of that could run,
however complete it was.

And it was complete. Slice 1 (#5752) already shipped verification, scoping, the
overlay, the catalog patch semantics, the full consumer wiring, the website
transport and the publish tool. A signed fact lands on
`ProviderModelOffering.limits` in `provider_lake.rs:764-812` and mints
`RouteLimits`, which `route_budget.rs:47-51` consults *before* the fallback
chain that currently ends at `LEGACY_DEEPSEEK_CONTEXT_WINDOW_TOKENS`. The gap
was never schema or consumer. It was that no key existed.

Anchor `cwf-2026-09`, Ed25519, generated by the founder with
`facts-publish.mjs keygen`. The private half lives outside every repository at
mode 0600 and was never read into this session: only the public half was derived
locally, and only the public half is committed. Both tables carry the same key —
`check-cloud-facts.mjs` now reports `OK (facts_version=1, 1 active production
keys)`, up from 0.

Why this has to land in the release rather than after it: a shipped binary can
only trust a key it was compiled with. There is no in-band command that installs
or widens trust, and `CODEWHALE_CLOUD_FACTS_PATH` verifies against this same
table, so a local envelope is not an escape hatch either. A client that ships
without the anchor can never be served a fact until it is replaced. Pinning it
now is what makes delivery possible at all; it does not by itself deliver
anything.

Still required before any fact reaches a user, and all of it is founder
authority: deploy `SUPABASE_URL` and the publication migration, confirm
`facts_current` grants and RLS, then separately approve signing and publish a
payload at a `facts_version` above the channel floor (1 today). This commit
approves trust in a key. It does not approve a publication, and none has
occurred.

cargo test -p codewhale-config --locked cloud_facts
  test result: ok. 30 passed; 0 failed; 668 filtered out
cargo test -p codewhale-cloud-facts --locked
  test result: ok. 17 passed; 0 failed
node web/scripts/check-cloud-facts.mjs
  check-cloud-facts: OK (facts_version=1, 1 active production keys)
cargo check --workspace --all-targets --locked: 0 errors, 0 warnings

No new tests: the existing cloud-facts suite already covers verification,
scoping and the empty-table inert path, and the parity gate is the check that
matters for a two-table anchor.

Refs: Linear SHA-6398, GitHub #5752.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X57KRgwqYkmmtVQScczqiL

Author: CodeWhale Bot

crates/config/src/cloud_facts/keys.rs

@@ -48,9 +48,27 @@ pub struct TrustedKey {
     pub status: KeyStatus,
 }
 
-/// Production trust is deliberately empty until a public anchor is approved.
-/// Tests inject their own fixture keys; a shipped binary cannot trust those keys.
-pub const TRUSTED_KEYS: &[TrustedKey] = &[];
+/// Pinned production trust anchors.
+///
+/// A shipped binary can only trust a key it was compiled with — there is no
+/// in-band command that installs or widens trust, and `CODEWHALE_CLOUD_FACTS_PATH`
+/// verifies against this same table, so a local envelope is no escape hatch.
+/// Adding a key here is therefore a release-gated decision, and the matching
+/// entry in `web/lib/cloud-facts/keys.ts` must stay byte-identical:
+/// `check:facts` fails when the two tables diverge.
+///
+/// Tests inject their own fixture keys; no fixture signature establishes
+/// production trust.
+pub const TRUSTED_KEYS: &[TrustedKey] = &[TrustedKey {
+    // Approved 2026-09-10. Private half held by the founder outside any
+    // repository; only this public anchor is committed.
+    key_id: "cwf-2026-09",
+    public_key: [
+        229, 221, 108, 200, 133, 179, 185, 249, 210, 78, 85, 107, 124, 85, 91, 236, 39, 143, 28,
+        190, 129, 220, 233, 125, 216, 136, 82, 215, 148, 26, 6, 133,
+    ],
+    status: KeyStatus::Active,
+}];
 
 /// Look up a pinned key by id.
 #[must_use]

web/lib/cloud-facts/keys.ts

@@ -5,9 +5,8 @@
  * the two diverge. Keys are pinned here (and in the binary); the Supabase
  * `facts_key` table is informational and never a trust root.
  *
- * No production signing anchor has been approved for this release. An empty
- * table disables delivery before any transport read. Tests supply their own
- * public fixture keys; those keys never belong in this table.
+ * The pinned anchor below is the trust root for delivery. Tests supply their
+ * own public fixture keys; those keys never belong in this table.
  */
 export type KeyStatus = "active" | "retired";
 
@@ -23,7 +22,15 @@ export const ENVELOPE_VERSION = 1;
 export const SUPPORTED_SCHEMA_VERSION = 1;
 export const MAX_PAYLOAD_BYTES = 512 * 1024;
 
-export const TRUSTED_KEYS: readonly TrustedKey[] = [];
+export const TRUSTED_KEYS: readonly TrustedKey[] = [
+  {
+    // Approved 2026-09-10. Mirrors crates/config/src/cloud_facts/keys.rs.
+    // Private half held by the founder outside any repository.
+    keyId: "cwf-2026-09",
+    publicKey: "5d1syIWzufnSTlVrfFVb7CePHL6B3Ol92IhS15QaBoU=",
+    status: "active",
+  },
+];
 
 export function trustedKey(keyId: string): TrustedKey | undefined {
   return TRUSTED_KEYS.find((key) => key.keyId === keyId);