feat(zastava): add evidence locker plan and schema examples

- Introduced README.md for Zastava Evidence Locker Plan detailing artifacts to sign and post-signing steps.
- Added example JSON schemas for observer events and webhook admissions.
- Updated implementor guidelines with checklist for CI linting, determinism, secrets management, and schema control.
- Created alert rules for Vuln Explorer to monitor API latency and projection errors.
- Developed analytics ingestion plan for Vuln Explorer, focusing on telemetry and PII guardrails.
- Implemented Grafana dashboard configuration for Vuln Explorer metrics visualization.
- Added expected projection SHA256 for vulnerability events.
- Created k6 load testing script for Vuln Explorer API.
- Added sample projection and replay event data for testing.
- Implemented ReplayInputsLock for deterministic replay inputs management.
- Developed tests for ReplayInputsLock to ensure stable hash computation.
- Created SurfaceManifestDeterminismVerifier to validate manifest determinism and integrity.
- Added unit tests for SurfaceManifestDeterminismVerifier to ensure correct functionality.
- Implemented Angular tests for VulnerabilityHttpClient and VulnerabilityDetailComponent to verify API interactions and UI rendering.

docs/modules/evidence-locker/bundle-packaging.md

@@ -38,6 +38,20 @@ The endpoint reuses `EvidenceBundlePackagingService` and caches the packaged obj
 
 ## Verification guidance
 
+Upcoming EB1–EB10 remediation (Sprint 0161; advisory `docs/product-advisories/28-Nov-2025 - Evidence Bundle and Replay Contracts.md`):
+- Publish `bundle.manifest.schema.json` and `checksums.schema.json` with canonical JSON rules and signatures.
+- Document the Merkle hash recipe and DSSE predicate/log policy.
+- Ship an offline verifier script and golden bundles/replay fixtures to prove determinism.
+- Add incident-mode activation/exit records and redaction/tenant isolation guidance for portable bundles.
+
+### Merkle recipe (example)
+```bash
+cd bundle
+find . -type f ! -name checksums.txt -print0 | sort -z | xargs -0 sha256sum > checksums.txt
+sha256sum checksums.txt | awk '{print $1}' > merkle-root.txt
+```
+Use the resulting root as the DSSE subject and store `checksums.txt` inside the bundle.
+
 1. Download `bundle.tgz` and read `instructions.txt`; the first section lists bundle id, root hash, and creation/timestamp information.
 2. Verify `checksums.txt` against the transferred archive to detect transit corruption.
 3. Use the StellaOps CLI (`stella evidence verify bundle.tgz`) or the provenance verifier library to validate `signature.json`.