feat(api): Implement Console Export Client and Models

- Added ConsoleExportClient for managing export requests and responses.
- Introduced ConsoleExportRequest and ConsoleExportResponse models.
- Implemented methods for creating and retrieving exports with appropriate headers.

feat(crypto): Add Software SM2/SM3 Cryptography Provider

- Implemented SmSoftCryptoProvider for software-only SM2/SM3 cryptography.
- Added support for signing and verification using SM2 algorithm.
- Included hashing functionality with SM3 algorithm.
- Configured options for loading keys from files and environment gate checks.

test(crypto): Add unit tests for SmSoftCryptoProvider

- Created comprehensive tests for signing, verifying, and hashing functionalities.
- Ensured correct behavior for key management and error handling.

feat(api): Enhance Console Export Models

- Expanded ConsoleExport models to include detailed status and event types.
- Added support for various export formats and notification options.

test(time): Implement TimeAnchorPolicyService tests

- Developed tests for TimeAnchorPolicyService to validate time anchors.
- Covered scenarios for anchor validation, drift calculation, and policy enforcement.

.gitea/workflows/findings-ledger-ci.yml

@@ -9,6 +9,10 @@ on:
     paths:
       - 'src/Findings/**'
       - '.gitea/workflows/findings-ledger-ci.yml'
+      - 'deploy/releases/2025.09-stable.yaml'
+      - 'deploy/releases/2025.09-airgap.yaml'
+      - 'deploy/downloads/manifest.json'
+      - 'ops/devops/release/check_release_manifest.py'
   pull_request:
     branches: [main, develop]
     paths:
@@ -210,6 +214,10 @@ jobs:
             exit 1
           fi
           echo "✓ Rollback successful - RLS disabled on all tables"
+      - name: Validate release manifests (production)
+        run: |
+          set -euo pipefail
+          python ops/devops/release/check_release_manifest.py
 
       - name: Re-apply RLS migration (idempotency check)
         run: |

.gitea/workflows/mock-dev-release.yml

@@ -26,10 +26,13 @@ jobs:
       - name: Compose config (dev + mock overlay)
         run: |
           set -euo pipefail
-          cd deploy/compose
-          docker compose --env-file env/dev.env.example --env-file env/mock.env.example \
-            -f docker-compose.dev.yaml -f docker-compose.mock.yaml config > /tmp/compose-mock-config.yaml
-          ls -lh /tmp/compose-mock-config.yaml
+          ops/devops/mock-release/config_check.sh
+
+      - name: Helm template (mock overlay)
+        run: |
+          set -euo pipefail
+          helm template mock ./deploy/helm/stellaops -f deploy/helm/stellaops/values-mock.yaml > /tmp/helm-mock.yaml
+          ls -lh /tmp/helm-mock.yaml
 
       - name: Upload mock release bundle
         uses: actions/upload-artifact@v3
@@ -38,3 +41,4 @@ jobs:
           path: |
             out/mock-release/mock-dev-release.tgz
             /tmp/compose-mock-config.yaml
+            /tmp/helm-mock.yaml