Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/modules/cli/guides/cli-reference.md

@@ -304,7 +304,20 @@ Additional notes:
 
 ---
 
-*Last updated: 2025-11-02 (Sprint 100).*
+## 7 · Policy lifecycle CLI quick start
+
+- `stella policy submit --policy <id> --version <n> --attach <simulation.json> --reviewers group`
+- `stella policy review --policy <id> --version <n> --request-changes|--approve`
+- `stella policy approve --policy <id> --version <n> --note "<justification>"`
+- `stella policy publish --policy <id> --version <n> --reason "<why>" --ticket SEC-2048 --sign`
+- `stella policy promote --policy <id> --version <n> --environment stage --note "<context>"`
+- `stella policy activate --policy <id> --version <n> --note "<deployment reason>"`
+
+All publish/promote operations require interactive identities with `policy:publish`/`policy:promote` and inject attestation metadata headers (`policy_reason`, `policy_ticket`, `policy_digest`). See [Policy Lifecycle & Approvals](../../../policy/lifecycle.md) § 3–4 for the full workflow and compliance checklist.
+
+---
+
+*Last updated: 2025-11-03 (Sprint 100).*
 
 ## 13. Authority configuration quick reference