fix(agentanchor): remove demo-data fakes from trust-engine + consumer portfolio

[vorionsys]

Summary

Track 1 PR-FAKE-3. Removes two user-facing silent-demo-fallback fakes from the agentanchor dashboard.

1. ConsumerPortfolio.tsx

Shipped with `const agents = []` and a `// TODO: Fetch actual agent data from API` comment. The Agent Portfolio card on the user profile always showed zero agents regardless of what the user actually owned. "Total Agents", "Active", and "Avg Trust Score" were all hardcoded to 0.

Fix: wire to `createClient()` from `@/lib/supabase/client` and query the `bots` table filtered by `user_id=profile.id`. Real loading, error, and empty states. "Avg Trust Score" and "Active" counts computed from live data.

2. trust-engine/page.tsx (Phase 6 dashboard)

`fetchPhase6Data()` had two fakes in one:

1. The `if (res.ok)` gate meant non-2xx responses silently did nothing — no error, no loading state change, no indication to the user that the backend was broken. Stats just stayed as whatever was last set.
2. The `catch` block silently fell back to `getDemoStats()` / `getDemoEvents()` with a `// Use demo data for now` comment — 47 fake agents, 1842 fabricated compliance events, 3291 made-up role-gate evaluations rendered as if they were live data.

Fix:

• Throw on non-ok responses so HTTP errors reach the catch
• Catch surfaces the real error message (HTTP status / exception text)
• New error-state UI with retry button instead of fabricating numbers
• Delete the local `getDemoStats` / `getDemoEvents` helpers entirely

Why this matters

AgentAnchor is a governance product. Hardcoded trust scores and fabricated compliance events are worse than useless — they create false confidence in a system that's actually broken. Real empty state + real error state > plausible fake data.

Test plan

• `npx tsc --noEmit` clean on both changed files (unrelated pre-existing errors in TrustBadge / phase6-repositories untouched)
• Load `/trust-engine` against a dev backend where Supabase is reachable — real stats render
• Load `/trust-engine` with Supabase env vars missing — error card with HTTP status + retry button appears (no fake 1842 compliance events)
• Load `/profile` with no agents in the bots table — proper "No agents yet" empty state + "Browse Marketplace" CTA (unchanged)
• Load `/profile` with 2 agents owned by the current user — both appear with real trust scores

Files changed

• apps/agentanchor/app/(dashboard)/trust-engine/page.tsx
• apps/agentanchor/components/profile/ConsumerPortfolio.tsx