Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/modules/attestor/evidence/2025-11-03-mongo-ttl-validation.txt

@@ -0,0 +1,55 @@
+Using database: attestor_ttl_validation
+true
+{ ok: 1 }
+Created collection and resetting indexes...
+dedupe_key_unique
+dedupe_ttl
+{
+  acknowledged: true,
+  insertedId: ObjectId("6909225d9ddb8e8caf11da28")
+}
+Inserted document scheduled to expire at 2025-11-03T21:45:21.054Z
+Current indexes:
+[
+  {
+    v: 2,
+    key: {
+      _id: 1
+    },
+    name: '_id_'
+  },
+  {
+    v: 2,
+    key: {
+      key: 1
+    },
+    name: 'dedupe_key_unique',
+    unique: true
+  },
+  {
+    v: 2,
+    key: {
+      ttlAt: 1
+    },
+    name: 'dedupe_ttl',
+    expireAfterSeconds: 0
+  }
+]
+Still present at 2025-11-03T21:45:06.275Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:09.473Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:14.492Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:19.510Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:24.532Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:29.565Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:34.590Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:37.779Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:42.799Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:47.818Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:52.838Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:45:57.855Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:46:02.875Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:46:07.885Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:46:11.070Z (waiting for TTL monitor)...
+Still present at 2025-11-03T21:46:16.075Z (waiting for TTL monitor)...
+Document expired and removed after 80.0 seconds.
+Remaining documents: 0

docs/modules/attestor/evidence/2025-11-03-redis-ttl-validation.txt

@@ -0,0 +1,13 @@
+redis> OK
+2025-11-03T21:49:38+00:00 ttl=45
+2025-11-03T21:49:41+00:00 ttl=42
+2025-11-03T21:49:46+00:00 ttl=37
+2025-11-03T21:49:51+00:00 ttl=32
+2025-11-03T21:49:56+00:00 ttl=27
+2025-11-03T21:50:01+00:00 ttl=22
+2025-11-03T21:50:06+00:00 ttl=17
+2025-11-03T21:50:11+00:00 ttl=12
+2025-11-03T21:50:14+00:00 ttl=8
+2025-11-03T21:50:20+00:00 ttl=3
+2025-11-03T21:50:25+00:00 ttl=-2
+Key expired after 47s

docs/modules/attestor/ttl-validation.md

@@ -39,3 +39,9 @@ If the helper script cannot be used:
 ## Ownership
 - Primary: Attestor Service Guild.
 - Partner: QA Guild (observes TTL metrics, confirms evidence archiving).
+
+## 2025-11-03 validation summary
+- **Stack:** `mongod` 7.0.5 (tarball) + `mongosh` 2.0.2, `redis-server` 7.2.4 (source build) running on localhost without Docker.
+- **Mongo results:** `dedupe` TTL index (`ttlAt`, `expireAfterSeconds: 0`) confirmed; document inserted with 20 s TTL expired automatically after ~80 s (expected allocator sweep). Evidence: `docs/modules/attestor/evidence/2025-11-03-mongo-ttl-validation.txt`.
+- **Redis results:** Key `attestor:ttl:live:bundle:validation` set with 45 s TTL reached `TTL=-2` after ~47 s confirming expiry propagation. Evidence: `docs/modules/attestor/evidence/2025-11-03-redis-ttl-validation.txt`.
+- **Notes:** Local binaries built/run to accommodate sandbox without Docker; services shut down after validation.