Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/modules/notify/architecture.md

@@ -514,11 +514,31 @@ sequenceDiagram
 * **Templates**: compile and cache per rule+channel+locale; version with rule `updatedAt` to invalidate.
 * **Rules**: store raw YAML + parsed AST; validate with schema + static checks (e.g., nonsensical combos).
 * **Secrets**: pluggable secret resolver (Authority Secret proxy, K8s, Vault).
-* **Rate limiting**: `System.Threading.RateLimiting` + per‑connector adapters.
+* **Rate limiting**: `System.Threading.RateLimiting` + per-connector adapters.
 
 ---
 
-## 19) Roadmap (post‑v1)
+## 19) Air-gapped bootstrap configuration
+
+Air-gapped deployments ship a deterministic Notifier profile inside the
+Bootstrap Pack. The artefacts live under `bootstrap/notify/` after running the
+Offline Kit builder and include:
+
+- `notify.yaml` — configuration derived from `etc/notify.airgap.yaml`, pointing
+  to the sealed MongoDB/Authority endpoints and loading connectors from the
+  local plug-in directory.
+- `notify-web.secret.example` — template for the Authority client secret,
+  intended to be renamed to `notify-web.secret` before deployment.
+- `README.md` — operator guide (`docs/modules/notify/bootstrap-pack.md`).
+
+These files are copied automatically by `ops/offline-kit/build_offline_kit.py`
+via `copy_bootstrap_configs`. Operators mount the configuration and secret into
+the `StellaOps.Notifier.WebService` container (Compose or Kubernetes) to keep
+sealed-mode roll-outs reproducible.
+
+---
+
+## 20) Roadmap (post-v1)
 
 * **PagerDuty/Opsgenie** connectors; **Jira** ticket creation.
 * **User inbox** (in‑app notifications) + mobile push via webhook relay.