Persist project-hook trust for a workspace root.
Note:
Failures (unreadable store, lock timeout, I/O errors) return False
without mutating the on-disk store. Callers must treat False as a
real persistence failure, not as an implicit session grant.
Workspace root to trust.
Alternate trust store path for tests.
