feat: add PolicyPackSelectorComponent with tests and integration

- Implemented PolicyPackSelectorComponent for selecting policy packs.
- Added unit tests for component behavior, including API success and error handling.
- Introduced monaco-workers type declarations for editor workers.
- Created acceptance tests for guardrails with stubs for AT1–AT10.
- Established SCA Failure Catalogue Fixtures for regression testing.
- Developed plugin determinism harness with stubs for PL1–PL10.
- Added scripts for evidence upload and verification processes.

docs/security/aoc-invariants.md

@@ -18,6 +18,9 @@ Last updated: 2025-11-25 (DOCS-ATTEST-75-002)
 
 ## Guardrails for implementers
 - Never permit unsigned or partially signed payloads to proceed past parsing.
+
+## Pending Update
+- Add risk scoring provenance guarantees (DOCS-RISK-68-002) once Export/Risk inputs land; due 2025-12-11 per sprint action tracker. Include deterministic hash list for any new examples or schemas.
 - Reject any outbound HTTP/S fetch during verification when `Attestor__Offline__Enabled=true`.
 - Keep secret material out of logs; log statement digests and key ids only.
 - Round numeric scores/weights only at the presentation boundary; internal math stays high-precision.