feat: Add Go module and workspace test fixtures

- Created expected JSON files for Go modules and workspaces.
- Added go.mod and go.sum files for example projects.
- Implemented private module structure with expected JSON output.
- Introduced vendored dependencies with corresponding expected JSON.
- Developed PostgresGraphJobStore for managing graph jobs.
- Established SQL migration scripts for graph jobs schema.
- Implemented GraphJobRepository for CRUD operations on graph jobs.
- Created IGraphJobRepository interface for repository abstraction.
- Added unit tests for GraphJobRepository to ensure functionality.

deploy/compose/README.md

@@ -17,6 +17,7 @@ These Compose bundles ship the minimum services required to exercise the scanner
 | `env/*.env.example` | Seed `.env` files that document required secrets and ports per profile. |
 | `scripts/backup.sh` | Pauses workers and creates tar.gz of Mongo/MinIO/Redis volumes (deterministic snapshot). |
 | `scripts/reset.sh` | Stops the stack and removes Mongo/MinIO/Redis volumes after explicit confirmation. |
+| `docker-compose.mock.yaml` | Dev-only overlay with placeholder digests for missing services (orchestrator, policy-registry, packs, task-runner, VEX/Vuln stack). Use only with mock release manifest `deploy/releases/2025.09-mock-dev.yaml`. |
 
 ## Usage
 
@@ -103,6 +104,20 @@ The Helm chart mirrors these settings under `services.advisory-ai-web` / `adviso
 1. Import the new manifest into `deploy/releases/` (see `deploy/README.md`).
 2. Update image digests in the relevant Compose file(s).
 3. Re-run `docker compose config` to confirm the bundle is deterministic.
+
+### Mock overlay for missing digests (dev only)
+
+Until official digests land, you can exercise Compose packaging with mock placeholders:
+
+```bash
+# assumes docker-compose.dev.yaml as the base profile
+docker compose --env-file env/dev.env.example \
+  -f docker-compose.dev.yaml \
+  -f docker-compose.mock.yaml \
+  config
+```
+
+The overlay pins the missing services (orchestrator, policy-registry, packs-registry, task-runner, VEX/Vuln stack) to mock digests from `deploy/releases/2025.09-mock-dev.yaml` and uses `sleep infinity` commands. Replace with real digests and service commands as soon as releases publish.
 
 Keep digests synchronized between Compose, Helm, and the release manifest to preserve reproducibility guarantees. `deploy/tools/validate-profiles.sh` performs a quick audit.