feat: add PolicyPackSelectorComponent with tests and integration

- Implemented PolicyPackSelectorComponent for selecting policy packs.
- Added unit tests for component behavior, including API success and error handling.
- Introduced monaco-workers type declarations for editor workers.
- Created acceptance tests for guardrails with stubs for AT1–AT10.
- Established SCA Failure Catalogue Fixtures for regression testing.
- Developed plugin determinism harness with stubs for PL1–PL10.
- Added scripts for evidence upload and verification processes.

docs/scripts/sbom-vex/chain-hash-recipe.md

@@ -0,0 +1,25 @@
+# SBOM→VEX Chain Hash Recipe (Stub)
+
+Use with sprint task 6 (SBOM-VEX-GAPS-300-013).
+
+- Inputs: sorted SBOM documents, VEX statements, DSSE envelopes, Rekor bundle snapshot.
+- Hashing: deterministic ordering (UTF-8, LF), SHA-256 over concatenated canonical JSON.
+- Chain: derive cumulative hash for (SBOM → DSSE → Rekor → VEX) and store in proof manifest.
+- Offline: no network; bundle Rekor root + snapshot; include `inputs.lock` with tool versions.
+
+Example (stub):
+
+```bash
+sbom_files=(sbom.json)
+vex_files=(vex.json)
+dsse=envelope.dsse
+rekor=rekor-bundle.json
+
+cat "${sbom_files[@]}" | jq -S . > /tmp/sbom.canon
+cat "${vex_files[@]}" | jq -S . > /tmp/vex.canon
+cat "$dsse" | jq -S . > /tmp/dsse.canon
+cat "$rekor" | jq -S . > /tmp/rekor.canon
+
+cat /tmp/sbom.canon /tmp/dsse.canon /tmp/rekor.canon /tmp/vex.canon | sha256sum | awk '{print $1}' > proof.chainhash
+echo "chain-hash: $(cat proof.chainhash)"
+```

docs/scripts/sbom-vex/verify.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Offline verifier stub for SBOM -> VEX proof bundles.
+# Expected inputs: path to DSSE envelope, Rekor log snapshot, and bundled trust roots.
+
+if [ "$#" -lt 4 ]; then
+  echo "usage: $0 <sbom.json> <vex.json> <dsse.envelope> <rekor-bundle.json>" >&2
+  exit 1
+fi
+
+SBOM="$1"
+VEX="$2"
+DSSE="$3"
+REKOR="$4"
+
+if ! command -v jq >/dev/null; then
+  echo "jq is required (offline-capable)." >&2
+  exit 2
+fi
+
+echo "[stub] canonicalising inputs..." >&2
+tmpdir=$(mktemp -d)
+trap 'rm -rf "$tmpdir"' EXIT
+
+jq -S . "$SBOM" > "$tmpdir/sbom.canon"
+jq -S . "$VEX" > "$tmpdir/vex.canon"
+jq -S . "$DSSE" > "$tmpdir/dsse.canon"
+jq -S . "$REKOR" > "$tmpdir/rekor.canon"
+
+cat "$tmpdir/sbom.canon" "$tmpdir/dsse.canon" "$tmpdir/rekor.canon" "$tmpdir/vex.canon" | sha256sum | awk '{print $1}' > "$tmpdir/proof.hash"
+echo "chain-hash (sbom+dsse+rekor+vex): $(cat "$tmpdir/proof.hash")"
+echo "[stub] verify DSSE signatures and Rekor inclusion separately; add manifests to DSSE envelope for full proof"