Refactor manifest trust store helpers

[codeforester]

Summary

• extract manifest command trust identity/store helpers into base_trust.trust_store
• keep existing base_trust.engine helper names as compatibility re-exports
• add focused coverage for the new module boundary

Validation

• PYTHONPATH=lib/python:cli/python $HOME/.base.d/base/.venv/bin/python -m pytest cli/python/base_trust/tests/test_engine.py::ManifestCommandTrustTests::test_engine_reexports_trust_store_helpers -q
• PYTHONPATH=lib/python:cli/python $HOME/.base.d/base/.venv/bin/python -m pytest cli/python/base_trust/tests/test_engine.py -q
• PYTHONPATH=lib/python:cli/python $HOME/.base.d/base/.venv/bin/python -m pytest cli/python/base_trust/tests/test_engine.py cli/python/base_projects/tests/test_engine.py cli/python/base_projects/tests/test_build_targets.py -q
• PYTHONPATH=lib/python:cli/python $HOME/.base.d/base/.venv/bin/python -m pylint cli/python/base_trust/engine.py cli/python/base_trust/trust_store.py cli/python/base_trust/tests/test_engine.py
• python3 -m compileall -q cli/python/base_trust/engine.py cli/python/base_trust/trust_store.py cli/python/base_trust/tests/test_engine.py
• git diff --check
• env BASE_BASH_LIBS_DIR=/Users/rameshhp/work/base-bash-libs/lib/bash BASE_CACHE_DIR=/private/tmp/base-1468-trust-smoke bin/basectl trust status base --workspace /Users/rameshhp/work --format json

Closes #1468