Describe both uses of sync --allow-unsigned

The flag now authorizes two distinct trust transitions: adopting an
install whose signature state cannot be established, and repairing a
lock entry that records no trust decision into an explicit unsigned
exception. Only the first was documented, so an operator reading
`sync --help` could approve a transition other than the one described,
and the remedy `thv ai-plugin info` names for an unrecorded entry was
undiscoverable from the command that performs it.

Regenerating also refreshes the TrustUnrecorded schema description,
which was left stale by the previous commit and was failing the Docs
check.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Signed-off-by: Samuele Verzi <samu@stacklok.com>

Author: samuv

cmd/thv/app/ai_plugin_sync.go

@@ -60,7 +60,9 @@ func init() {
 	aiPluginSyncCmd.Flags().BoolVar(&aiPluginSyncYes, "yes", false,
 		"Skip the confirmation prompt (required when not running interactively)")
 	aiPluginSyncCmd.Flags().BoolVar(&aiPluginSyncAllowUnsigned, "allow-unsigned", false,
-		"Allow adopting plugins whose signature state cannot be established (recorded as unsigned)")
+		"Record plugins as unsigned in the lock file: when adopting installs whose signature state "+
+			"cannot be established (--adopt), and when repairing an entry that records no trust "+
+			"decision and whose content is unsigned")
 	AddFormatFlag(aiPluginSyncCmd, &aiPluginSyncFormat)
 }
 

docs/cli/thv_ai-plugin_sync.md

@@ -115,8 +115,11 @@ type syncPluginsRequest struct {
 	Check bool `json:"check,omitempty"`
 	// Adopt writes lock entries for existing unmanaged project-scope installs
 	Adopt bool `json:"adopt,omitempty"`
-	// AllowUnsigned permits adopting plugins whose signature state cannot be
-	// established, recording them as unsigned
+	// AllowUnsigned permits recording a plugin as unsigned in the lock file,
+	// in two cases: adopting an install whose signature state cannot be
+	// established (see Adopt), and repairing an entry that records no trust
+	// decision at all, whose reinstall otherwise fails closed on unsigned
+	// content.
 	AllowUnsigned bool `json:"allow_unsigned,omitempty"`
 }