feat: surface Gemara bundle metadata in list and get commands Body:

.gitignore

@@ -77,6 +77,7 @@ gha-creds-*.json
 # Runtime data under .uf/ (databases, caches, locks, logs)
 .uf/workflows/
 .uf/artifacts/
+.uf/feedback/
 .uf/dewey/graph.db
 .uf/dewey/graph.db-shm
 .uf/dewey/graph.db-wal

AGENTS.md

@@ -285,6 +285,7 @@ packages organized by domain responsibility.
 
 ## Recent Changes
 - complypack-cache-versioning: `COMPLYTIME_CACHE_VERSIONS` env var configures retention count (default 1) for complypack cache versions per evaluator-id; `NewComplypackCache()` gains `*State` parameter for state-driven lookup and timestamp-based eviction ordering; `evictOldVersions()` becomes retention-count-aware (orphaned dirs first, then oldest by `LastUpdated`); `LookupByEvaluatorID()` resolves from state.json with directory-scan fallback; `SyncComplypack()` checks local cache before remote fetch with re-verification when verifier is configured, returns `(true, nil)` for cache hits to trigger generation invalidation; `EvaluatorIDToVersion()` reverse lookup on `*State`; `CacheRetentionCount()` in `internal/cache/retention.go`; `CheckComplypacks()` extended with `walkCacheSize()` and `findOrphanedVersions()` for cache health reporting; `complyctl doctor` reports cache size and orphaned/untracked versions (#676)
+- bundle-metadata-cli: `complyctl list` gains EVALUATOR and CONTROLS columns sourced from `PolicyState` metadata in `state.json`; `complyctl get` prints post-sync summary to stderr after fresh fetch showing policy title, evaluator, control count, and assessment count; `PolicyState` gains `PolicyTitle`/`PolicyEvaluator`/`ControlCount`/`AssessmentCount` fields populated at sync time via `SetPolicyMetadata()`; `policy.Resolver.ExtractPolicyMetadata()` extracts display metadata without building full `DependencyGraph`; `policyLayerResult.Title` added to `parsePolicyLayer()` output; upgrade backfill for pre-existing caches without metadata; `formatPolicySummary()` helper for testable stderr output (#506)
 - per-entry-verification: Per-entry `verification:` and `skip_verify:` fields on `PolicyEntry` in `internal/complytime/config.go` for policy-level signature verification overrides; `resolveVerifier()` in `cmd/complyctl/cli/get.go` with verifier cache and resolution priority chain (entry → workspace → none); error collection in `syncAllPolicies()`/`syncAllComplypacks()` via `errors.Join()` for partial-failure resilience; cross-group error collection in `syncAll()` so policy failures do not block complypack sync; per-entry WARNING to stderr on sync failure for real-time feedback; `validateEntries()` extended for per-entry verification validation and mutual exclusivity of `verification:` and `skip_verify:` (#680)
 - debug-visible-output: `--debug` flag now tees all log messages to stderr via `teeWriter` in `pkg/log/log.go`; `enableDebug()` in `cmd/complyctl/cli/root.go` reconstructs logger with `NewTeeWriter(stderr, logFile)` and forces `termenv.ANSI256` color profile when stderr is a TTY (respects `NO_COLOR`); `Debug log: <path>` hint printed to stderr after workspace resolution; flag description updated to `"output debug logs to stderr and log file"`; `SetColorProfile()` method added to `CharmHclog` adapter (#614)
 - sigstore-verification: `complyctl get` verifies OCI artifact signatures via `sigstore-go` when `verification:` configured in `complytime.yaml`; keyless (OIDC issuer + identity) and keyed (public key) modes; pre-copy verification via registry API before `oras.Copy()`; `--skip-verify` flag; `VerificationConfig` in `WorkspaceConfig`; `VerifyFunc`/`NewKeylessVerifier`/`NewKeyedVerifier` in `internal/cache/verify.go`; `PolicyState` gains `Verified`/`SignerIdentity`/`Issuer`/`VerifiedAt` fields; `SyncOption`/`WithVerifier()` functional options on `Sync`/`ComplypackSync`; `complyctl list` VERIFIED column; `complyctl doctor` `CheckVerification` diagnostic; `sigstore-go` v1.2.1 + `go-containerregistry` dependencies added

CHANGELOG.md

@@ -2,6 +2,24 @@
 
 ## Unreleased
 
+### Added
+
+- `complyctl list` now displays EVALUATOR and CONTROLS columns
+  showing the evaluator type and control count for each cached
+  policy. Metadata is sourced from cached state populated during
+  `complyctl get`. Pre-existing caches show "-" until re-fetched.
+  (#506)
+
+- `complyctl get` now prints a post-sync summary to stderr after
+  fetching a policy, showing the policy title, evaluator, control
+  count, and assessment count. The summary appears only for freshly
+  fetched policies. (#506)
+
+- `PolicyState` in `state.json` gains `policy_title`,
+  `policy_evaluator`, `control_count`, and `assessment_count` fields
+  populated at sync time. Backward compatible via `omitempty` JSON
+  tags. (#506)
+
 ### Fixed
 
 - `complyctl get` recorded the OCI tag version (e.g., `v1.0.0`) in