feat(zastava): add evidence locker plan and schema examples

- Introduced README.md for Zastava Evidence Locker Plan detailing artifacts to sign and post-signing steps.
- Added example JSON schemas for observer events and webhook admissions.
- Updated implementor guidelines with checklist for CI linting, determinism, secrets management, and schema control.
- Created alert rules for Vuln Explorer to monitor API latency and projection errors.
- Developed analytics ingestion plan for Vuln Explorer, focusing on telemetry and PII guardrails.
- Implemented Grafana dashboard configuration for Vuln Explorer metrics visualization.
- Added expected projection SHA256 for vulnerability events.
- Created k6 load testing script for Vuln Explorer API.
- Added sample projection and replay event data for testing.
- Implemented ReplayInputsLock for deterministic replay inputs management.
- Developed tests for ReplayInputsLock to ensure stable hash computation.
- Created SurfaceManifestDeterminismVerifier to validate manifest determinism and integrity.
- Added unit tests for SurfaceManifestDeterminismVerifier to ensure correct functionality.
- Implemented Angular tests for VulnerabilityHttpClient and VulnerabilityDetailComponent to verify API interactions and UI rendering.

scripts/airgap/verify-offline-kit.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Minimal verifier sample for AIRGAP-VERIFY-510-014. Adjust paths to your kit.
+
+KIT_ROOT=${1:-./offline-kit}
+MANIFEST="$KIT_ROOT/manifest.json"
+SIG="$KIT_ROOT/manifest.dsse"
+
+echo "[*] Verifying manifest signature..."
+cosign verify-blob --key trust-roots/manifest.pub --signature "$SIG" "$MANIFEST"
+
+echo "[*] Checking chunk hashes..."
+python - <<'PY'
+import json, hashlib, sys, os
+manifest_path=os.environ.get('MANIFEST') or sys.argv[1]
+with open(manifest_path) as f:
+    data=json.load(f)
+ok=True
+for entry in data.get('chunks', []):
+    path=os.path.join(os.path.dirname(manifest_path), entry['path'])
+    h=hashlib.sha256()
+    with open(path,'rb') as fh:
+        h.update(fh.read())
+    if h.hexdigest()!=entry['sha256']:
+        ok=False
+        print(f"HASH MISMATCH {entry['path']}")
+if not ok:
+    sys.exit(4)
+PY
+
+echo "[*] Done."