enhancement: make workspace trust status output concise and scannable #2625

Goal

Make the project-less basectl trust status output a concise, scannable workspace report while retaining full review guidance for a single project.

Background

With no project argument, trust status reports every discovered command-bearing project. Its current TTY path renders the full per-project report repeatedly: identity and digest details, trust-scope text, review commands, and allow commands. This makes a workspace inventory difficult to scan.

PR #2619 aligned blocked-trust explanations across test preflight and command diagnostics. This issue is a separate presentation improvement: preserve the basectl trust status [project] interface and make only the workspace-wide text view follow Base's compact workspace-report style.

Scope

• Render a workspace header with its root and discovered command-bearing project count.
• Render one compact row per project with project name, status, and a short reason. Put blocked projects before allowed projects and use readable reasons for not approved, manifest changed, and test requirements changed.
• Show aggregate allowed/blocked counts and a concise next step for opening one project's detailed status.
• State the trust-scope limitation once for the workspace report, rather than repeating it per project.
• Keep the explicit single-project text output, JSON/YAML/CSV/TSV contracts, trust decisions, exit behavior, and review/allow guidance unchanged.
• Update focused tests, command documentation, and the changelog.

Acceptance Criteria

• Project-less TTY output has one workspace header, one row per discovered command-bearing project, and one aggregate summary.
• Each blocked row gives a concise, accurate reason; allowed rows do not print identity digests or per-project instructions.
• The trust-scope limitation is rendered at most once in the workspace view.
• A concise next step points users to basectl trust status <project> for detailed review guidance.
• Explicit single-project text output remains detailed and unchanged.
• JSON, YAML, CSV, and TSV output and their schemas/columns remain unchanged.
• Trust state, approval rules, exit status, and command interface remain unchanged.
• Focused tests cover empty, all-allowed, mixed, and all-blocked workspace results and the three blocked reasons.

Validation

• Run the focused trust-status Python tests.
• Run relevant Base workspace/trust integration coverage and the full Base test gate.
• Run stable compatibility checks, relevant Python lint, and git diff --check.

Docs Impact

• Update docs/manifest-command-trust.md and the command reference to explain the concise workspace text view and detailed project view.
• Structured output documentation and schemas: no impact; machine-readable contracts remain unchanged.
• .ai-context/: no impact; this changes presentation detail without changing command ownership, workflows, trust semantics, or product boundaries.

Non-Goals

• Do not move the command under basectl workspace or add an alias.
• Do not change the trust identity, store, approval policy, execution behavior, or machine-readable output contract.
• Do not redesign explicit single-project diagnostics.
• Do not filter discovered projects. The report intentionally lists blocked projects before allowed projects.

Project Fields

• Status: In Progress
• Priority: P2
• Area: CLI
• Initiative: Adoption Polish
• Size: S
• Milestone: v1.11.0
• Category: enhancement

Agent Assignment

Assignee: codeforester. Implement one focused issue-backed PR; leave it open for review.