Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/modules/cli/architecture.md

@@ -128,10 +128,14 @@ src/
   * Imports a previously exported bundle into the local KMS root (`kms/` by default), promotes the imported version to `Active`, and preserves existing versions by marking them `PendingRotation`. Prompts for the passphrase when not provided to keep automation password-safe.
 
 Both subcommands honour offline-first expectations (no network access) and normalise relative roots via `--root` when operators mirror the credential store.
-
----
-
-## 3) AuthN: Authority + DPoP
+
+### 2.11 Air-gap guard
+
+- CLI outbound HTTP flows (Authority auth, backend APIs, advisory downloads) route through `StellaOps.AirGap.Policy`. When sealed mode is active the CLI refuses commands that would require external egress and surfaces the shared `AIRGAP_EGRESS_BLOCKED` remediation guidance instead of attempting the request.
+
+---
+
+## 3) AuthN: Authority + DPoP
 
 ### 3.1 Token acquisition
 

docs/modules/cli/guides/cli-reference.md

@@ -304,7 +304,20 @@ Additional notes:
 
 ---
 
-*Last updated: 2025-11-02 (Sprint 100).*
+## 7 · Policy lifecycle CLI quick start
+
+- `stella policy submit --policy <id> --version <n> --attach <simulation.json> --reviewers group`
+- `stella policy review --policy <id> --version <n> --request-changes|--approve`
+- `stella policy approve --policy <id> --version <n> --note "<justification>"`
+- `stella policy publish --policy <id> --version <n> --reason "<why>" --ticket SEC-2048 --sign`
+- `stella policy promote --policy <id> --version <n> --environment stage --note "<context>"`
+- `stella policy activate --policy <id> --version <n> --note "<deployment reason>"`
+
+All publish/promote operations require interactive identities with `policy:publish`/`policy:promote` and inject attestation metadata headers (`policy_reason`, `policy_ticket`, `policy_digest`). See [Policy Lifecycle & Approvals](../../../policy/lifecycle.md) § 3–4 for the full workflow and compliance checklist.
+
+---
+
+*Last updated: 2025-11-03 (Sprint 100).*
 
 ## 13. Authority configuration quick reference