feat: add PolicyPackSelectorComponent with tests and integration

- Implemented PolicyPackSelectorComponent for selecting policy packs.
- Added unit tests for component behavior, including API success and error handling.
- Introduced monaco-workers type declarations for editor workers.
- Created acceptance tests for guardrails with stubs for AT1–AT10.
- Established SCA Failure Catalogue Fixtures for regression testing.
- Developed plugin determinism harness with stubs for PL1–PL10.
- Added scripts for evidence upload and verification processes.

docs/security/vuln-rbac.md

@@ -0,0 +1,16 @@
+# Vuln Explorer RBAC & ABAC (Md.XI draft)
+
+> Status: DRAFT — pending security review and GRAP0101. Do not publish until roles/claims verified.
+
+## Scope
+- Roles/scopes, ABAC policies, attachment encryption/CSRF considerations for Vuln Explorer.
+
+## Dependencies
+- Security review; GRAP0101 identifiers; attachment token wording from Authority.
+
+## Outline
+- Scopes: vuln:view/investigate/operate/audit (+ legacy read).
+- ABAC filters: vuln_env, vuln_owner, vuln_business_tier; enforcement in tokens/permalinks.
+- Attachment tokens: issuance/verify; encryption notes; CSRF protections.
+
+_Last updated: 2025-12-05 (UTC)_