pub const USER_PIN_FILE: &str = "user.pub";Expand description
File in the user daemon’s run dir (<run>/<id>/user.pub, outside the
project tree) pinning the trusted user key as 64 lowercase hex. Written by
the supervisor with write_user_pin. When present the child trusts only
this key and refuses a certificate issued by another. It assumes whatever
runs inside the project (the Phase 4 sandbox) cannot write the run dir;
when absent (Phase 2 development) the child falls back to the key in its
own certificate and logs a warning.