feat: Implement air-gap functionality with timeline impact and evidence snapshot services

- Added AirgapTimelineImpact, AirgapTimelineImpactInput, and AirgapTimelineImpactResult records for managing air-gap bundle import impacts.
- Introduced EvidenceSnapshotRecord, EvidenceSnapshotLinkInput, and EvidenceSnapshotLinkResult records for linking findings to evidence snapshots.
- Created IEvidenceSnapshotRepository interface for managing evidence snapshot records.
- Developed StalenessValidationService to validate staleness and enforce freshness thresholds.
- Implemented AirgapTimelineService for emitting timeline events related to bundle imports.
- Added EvidenceSnapshotService for linking findings to evidence snapshots and verifying their validity.
- Introduced AirGapOptions for configuring air-gap staleness enforcement and thresholds.
- Added minimal jsPDF stub for offline/testing builds in the web application.
- Created TypeScript definitions for jsPDF to enhance type safety in the web application.

docs/risk/explainability.md

@@ -25,7 +25,6 @@
 - No live calls; all captures from frozen fixtures. Use exact ordering and timestamps when regenerating.
 
 ## Open Items
-- Capture UI telemetry screenshots/frames for console + CLI to replace textual description.
 - Add schema file once JSON schema is frozen; update references accordingly.
 
 ## References

docs/risk/samples/explain/SHA256SUMS

@@ -1,4 +1,4 @@
 30a64dcc9fb41d06774a9c125456c212a29915a083cd1d2170f16f343bd0764f  README.md
-4bba11375e9f06942e988dd6cd30e7005fe3b040009b3fffca4e6d36a1875ab3  cli-explain.txt
-22c87e16d5a5cd89f60660eeb07b319989c38f2aa0243da88a312bee1841dda6  console-frame.json
+abcacb431d35d649a0deae81aecce9996b28304da6342a083f9616af6b1ca6a2  cli-explain.txt
+f3f1b41f5261f50f3fc104ebeeb2649cc9866d04f9634228778551e6c3364cb8  console-frame.json
 1d2e56eebf0a266f80519f073e1db532c4a4f2d7fa604ea5c05d4e208719cc7c  explain-trace.json

docs/risk/samples/explain/cli-explain.txt

@@ -1,12 +1,15 @@
-stella risk explain job-001 --tenant tenant-default --json false
+stella risk explain job-001 --tenant tenant-default
+==================================================
 Finding: finding-123
 Profile: default-profile v1.0.0 (hash sha256:profilehash)
-Score: 0.85 (high)
+Score: 0.85 (HIGH)
 Gates: kev_and_reachability
-Contributions:
-- cvss          0.40 (raw 7.5, source nvd, provenance sha256:cvsshash)
-- kev           0.30 (raw true, source cisa, provenance sha256:kevhash)
-- reachability  0.30 (raw 0.9, source scanner, provenance sha256:reachhash)
+
+Contributions (ordered)
+- cvss          0.40   raw=7.5     source=nvd      prov=sha256:cvsshash
+- kev           0.30   raw=true    source=cisa     prov=sha256:kevhash
+- reachability  0.30   raw=0.9     source=scanner  prov=sha256:reachhash
+
 Overrides: kev-boost (Known Exploited Vulnerability)
 Provenance: job sha256:jobhash | fixtures [sha256:cvsshash, sha256:kevhash, sha256:reachhash]
 Timestamp: 2025-12-05T00:00:02Z

docs/risk/samples/explain/console-frame.json

@@ -1,19 +1,22 @@
 {
   "frame_id": "console-explain-001",
   "captured_at": "2025-12-05T00:05:00Z",
+  "ui_version": "1.0.0",
+  "tenant_id": "tenant-default",
   "finding_id": "finding-123",
   "profile_id": "default-profile",
+  "profile_hash": "sha256:profilehash",
   "score": 0.85,
   "severity": "high",
   "gates": ["kev_and_reachability"],
   "top_contributors": [
-    {"factor": "cvss", "contribution": 0.4, "raw": 7.5, "provenance": "sha256:cvsshash"},
-    {"factor": "kev", "contribution": 0.3, "raw": true, "provenance": "sha256:kevhash"},
-    {"factor": "reachability", "contribution": 0.3, "raw": 0.9, "provenance": "sha256:reachhash"}
+    {"factor": "cvss", "contribution": 0.4, "raw": 7.5, "source": "nvd", "provenance": "sha256:cvsshash"},
+    {"factor": "kev", "contribution": 0.3, "raw": true, "source": "cisa", "provenance": "sha256:kevhash"},
+    {"factor": "reachability", "contribution": 0.3, "raw": 0.9, "source": "scanner", "provenance": "sha256:reachhash"}
   ],
-  "provenance": {"job_hash": "sha256:jobhash"},
   "charts": {
-    "donut": {"high": 1},
+    "donut": {"critical": 0, "high": 1, "medium": 0, "low": 0, "informational": 0},
     "stacked": [0.4, 0.3, 0.3]
-  }
+  },
+  "provenance": {"job_hash": "sha256:jobhash", "fixtures": ["sha256:cvsshash", "sha256:kevhash", "sha256:reachhash"]}
 }