Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

samples/api/scheduler/policy-simulation-metrics.json

@@ -0,0 +1,17 @@
+{
+  "policy_simulation_queue_depth": {
+    "total": 3,
+    "by_status": {
+      "pending": 2,
+      "dispatching": 1
+    }
+  },
+  "policy_simulation_latency": {
+    "samples": 2,
+    "p50_seconds": 1.5,
+    "p90_seconds": 2.5,
+    "p95_seconds": 3.5,
+    "p99_seconds": 4.0,
+    "mean_seconds": 2.0
+  }
+}

samples/api/scheduler/policy-simulation-status.json

@@ -0,0 +1,29 @@
+{
+  "simulation": {
+    "schemaVersion": "scheduler.policy-run-status@1",
+    "runId": "run:P-7:20251103T153000Z:e4d1a9b2",
+    "tenantId": "tenant-alpha",
+    "policyId": "P-7",
+    "policyVersion": 4,
+    "mode": "simulate",
+    "status": "queued",
+    "priority": "normal",
+    "queuedAt": "2025-11-03T15:30:00Z",
+    "stats": {
+      "components": 0,
+      "rulesFired": 0,
+      "findingsWritten": 0,
+      "vexOverrides": 0
+    },
+    "inputs": {
+      "sbomSet": [
+        "sbom:S-318",
+        "sbom:S-42"
+      ],
+      "captureExplain": true
+    },
+    "metadata": {
+      "source": "console.review"
+    }
+  }
+}

samples/api/scheduler/policy-simulation-webhook.json

@@ -0,0 +1,32 @@
+{
+  "tenantId": "tenant-alpha",
+  "simulation": {
+    "runId": "run:policy-risk:20251103T195901Z:deadbeef",
+    "tenantId": "tenant-alpha",
+    "policyId": "policy-risk",
+    "policyVersion": 7,
+    "mode": "simulate",
+    "status": "succeeded",
+    "priority": "normal",
+    "queuedAt": "2025-11-03T19:59:01Z",
+    "startedAt": "2025-11-03T19:59:05Z",
+    "finishedAt": "2025-11-03T19:59:16Z",
+    "attempts": 1,
+    "inputs": {
+      "sbomSet": [
+        "sbom://sha256-alpha",
+        "sbom://sha256-bravo"
+      ],
+      "captureExplain": true
+    },
+    "metadata": {
+      "requestedby": "console-user",
+      "correlation-id": "policy-sim-4242"
+    },
+    "cancellationRequested": false,
+    "schemaVersion": "1.0.0"
+  },
+  "result": "succeeded",
+  "observedAt": "2025-11-03T19:59:16Z",
+  "latencySeconds": 15.0
+}