Define transitive trust for referenced sub-recipes

**What problem would this solve?**

Desktop recipe trust currently identifies the top-level recipe, while referenced sub-recipes are loaded later from their paths. If referenced content changes after the top-level recipe was accepted, the prior decision does not clearly define whether the changed child is still trusted.

**What would a good outcome look like?**

Goose has an explicit transitive trust model for referenced recipes. A user’s acceptance applies to identifiable content, and any relevant child change is detected before delegation without leaving a time-of-check/time-of-use gap.

**Possible approaches**

- Snapshot and hash the complete resolved recipe graph when trust is granted, then revalidate the relevant child at delegation.
- Store recursive content digests and invalidate acceptance when any referenced recipe changes.
- Require an independent trust decision for each referenced recipe when it is first delegated to.

The design should define cycles, missing or remote references, nested recipes, and compatibility with existing accepted-recipe records.

**Additional context**

- [x] I have verified this does not duplicate an existing feature request

Do not begin implementation until the issue reaches **Ready** on the [Goose Issues board](https://github.com/orgs/aaif-goose/projects/1).