Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

docs/modules/scheduler/architecture.md

@@ -269,6 +269,8 @@ At cron tick:
 * `scheduler.run_latency_seconds{quantile}` // event → first verdict
 * `scheduler.delta_images_total{severity}`
 * `scheduler.rate_limited_total{reason}`
+* `policy_simulation_queue_depth{status}` (WebService gauge)
+* `policy_simulation_latency_seconds` (WebService histogram)
 
 **Targets**
 
@@ -278,6 +280,12 @@ At cron tick:
 
 **Tracing** (OTEL): spans `plan`, `resolve`, `enqueue`, `report_call`, `persist`, `emit`.
 
+**Webhooks**
+
+* Policy simulation webhooks fire on terminal states (`succeeded`, `failed`, `cancelled`).
+* Configure under `Scheduler:Worker:Policy:Webhook` (see `SCHED-WEB-27-002-POLICY-SIMULATION-WEBHOOKS.md`).
+* Requests include headers `X-StellaOps-Tenant` and `X-StellaOps-Run-Id` for idempotency.
+
 ---
 
 ## 10) Configuration (YAML)