Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

src/Cli/StellaOps.Cli/TASKS.md

@@ -12,6 +12,11 @@
 > 2025-10-27: CLI reference now reflects final summary fields/JSON schema, quickstart includes verification/dry-run workflows, and API reference tables list both `sources ingest --dry-run` and `aoc verify`.
 > 2025-11-01: Update CLI auth defaults to request `attestor.verify` (and `attestor.read` for list/detail) after Attestor scope split; tokens without new scopes will fail verification calls.
 
+## Replay Enablement
+| ID | Status | Owner(s) | Depends on | Description | Exit Criteria |
+|----|--------|----------|------------|-------------|---------------|
+| CLI-REPLAY-187-002 | TODO | DevEx/CLI Guild | REPLAY-CORE-185-001, SCAN-REPLAY-186-001 | Implement `scan --record`, `verify`, `replay`, and `diff` commands with offline bundle resolution; update `docs/modules/cli/architecture.md` appendix referencing `docs/replay/DEVS_GUIDE_REPLAY.md`. | Commands tested (unit/integration); docs merged; offline workflows validated with sample bundles. |
+
 ## Policy Engine v2
 
 | ID | Status | Owner(s) | Depends on | Description | Exit Criteria |