feat: add PolicyPackSelectorComponent with tests and integration

- Implemented PolicyPackSelectorComponent for selecting policy packs.
- Added unit tests for component behavior, including API success and error handling.
- Introduced monaco-workers type declarations for editor workers.
- Created acceptance tests for guardrails with stubs for AT1–AT10.
- Established SCA Failure Catalogue Fixtures for regression testing.
- Developed plugin determinism harness with stubs for PL1–PL10.
- Added scripts for evidence upload and verification processes.

docs/risk/explainability.md

@@ -0,0 +1,36 @@
+# Risk Explainability (draft outline)
+
+> Draft scaffold; fill once 66-004 outputs and UI telemetry captures arrive. Keep fixtures deterministic (frozen payloads, stable ordering, SHA tables).
+
+## Purpose
+- Show how the scoring engine produces per-factor contributions and traces that UI/CLI/export surfaces render for auditors and operators.
+
+## Scope & Audience
+- Audience: Console/CLI users, auditors, SREs.
+- In scope: explainability payload shape, field meanings, provenance, UI/CLI mapping, offline/export behavior.
+- Out of scope: formula math (see `formulas.md`), API specifics (see `api.md`).
+
+## Payload Shape (pending)
+- Envelope fields: score, severity, factors[], provenance, timestamps (UTC), profile version, environment.
+- Factor entry fields: id, type, input_value, normalized_value, weight, contribution, source, evidence_refs[].
+- UI/CLI expectations: stable ordering, highlight top contributors, include attestation status.
+
+## UI/CLI Views (to fill)
+- Console panels and charts (needs telemetry captures)
+- CLI `stella risk explain` output (deterministic table examples)
+- Export Center bundles (JSON + CSV + hash manifests)
+
+## Determinism & Offline Posture
+- Store example payloads under `docs/risk/samples/`; record `SHA256SUMS`.
+- No live calls; all captures from frozen fixtures.
+
+## Open Items
+- Capture UI telemetry (Console Guild) and CLI sample outputs.
+- Finalize explainability JSON schema once 66-004 is approved.
+
+## References
+- `docs/risk/overview.md`
+- `docs/risk/profiles.md`
+- `docs/risk/factors.md`
+- `docs/risk/formulas.md`
+- `docs/risk/api.md`