Add unit tests for SBOM ingestion and transformation

- Implement `SbomIngestServiceCollectionExtensionsTests` to verify the SBOM ingestion pipeline exports snapshots correctly.
- Create `SbomIngestTransformerTests` to ensure the transformation produces expected nodes and edges, including deduplication of license nodes and normalization of timestamps.
- Add `SbomSnapshotExporterTests` to test the export functionality for manifest, adjacency, nodes, and edges.
- Introduce `VexOverlayTransformerTests` to validate the transformation of VEX nodes and edges.
- Set up project file for the test project with necessary dependencies and configurations.
- Include JSON fixture files for testing purposes.

src/Findings/StellaOps.Findings.Ledger/Services/LedgerProjectionReducer.cs

@@ -0,0 +1,247 @@
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using StellaOps.Findings.Ledger.Domain;
+using StellaOps.Findings.Ledger.Hashing;
+using StellaOps.Findings.Ledger.Infrastructure.Policy;
+
+namespace StellaOps.Findings.Ledger.Services;
+
+public static class LedgerProjectionReducer
+{
+    public static ProjectionReduceResult Reduce(
+        LedgerEventRecord record,
+        FindingProjection? current,
+        PolicyEvaluationResult evaluation)
+    {
+        ArgumentNullException.ThrowIfNull(record);
+        ArgumentNullException.ThrowIfNull(evaluation);
+
+        var eventObject = record.EventBody["event"]?.AsObject()
+            ?? throw new InvalidOperationException("Ledger event payload is missing 'event' object.");
+        var payload = eventObject["payload"] as JsonObject;
+
+        var status = evaluation.Status ?? DetermineStatus(record.EventType, payload, current?.Status);
+        var severity = evaluation.Severity ?? DetermineSeverity(payload, current?.Severity);
+
+        var labels = CloneLabels(evaluation.Labels);
+        MergeLabels(labels, payload);
+
+        var explainRef = evaluation.ExplainRef ?? DetermineExplainRef(payload, current?.ExplainRef);
+        var rationale = CloneArray(evaluation.Rationale);
+        if (rationale.Count == 0 && !string.IsNullOrWhiteSpace(explainRef))
+        {
+            rationale.Add(explainRef);
+        }
+
+        var updatedAt = record.RecordedAt;
+
+        var provisional = new FindingProjection(
+            record.TenantId,
+            record.FindingId,
+            record.PolicyVersion,
+            status,
+            severity,
+            labels,
+            record.EventId,
+            explainRef,
+            rationale,
+            updatedAt,
+            string.Empty);
+
+        var cycleHash = ProjectionHashing.ComputeCycleHash(provisional);
+        var projection = provisional with { CycleHash = cycleHash };
+
+        var historyEntry = new FindingHistoryEntry(
+            record.TenantId,
+            record.FindingId,
+            record.PolicyVersion,
+            record.EventId,
+            projection.Status,
+            projection.Severity,
+            record.ActorId,
+            DetermineComment(payload),
+            record.OccurredAt);
+
+        var actionEntry = CreateActionEntry(record, payload);
+        return new ProjectionReduceResult(projection, historyEntry, actionEntry);
+    }
+
+    private static string DetermineStatus(string eventType, JsonObject? payload, string? currentStatus)
+    {
+        var candidate = ExtractString(payload, "status") ?? currentStatus;
+
+        return eventType switch
+        {
+            LedgerEventConstants.EventFindingCreated => candidate ?? "affected",
+            LedgerEventConstants.EventFindingStatusChanged => candidate ?? currentStatus ?? "affected",
+            LedgerEventConstants.EventFindingClosed => candidate ?? "closed",
+            LedgerEventConstants.EventFindingAcceptedRisk => candidate ?? "accepted_risk",
+            _ => candidate ?? currentStatus ?? "affected"
+        };
+    }
+
+    private static decimal? DetermineSeverity(JsonObject? payload, decimal? current)
+    {
+        if (payload is null)
+        {
+            return current;
+        }
+
+        if (payload.TryGetPropertyValue("severity", out var severityNode))
+        {
+            if (TryConvertDecimal(severityNode, out var severity))
+            {
+                return severity;
+            }
+
+            if (severityNode is JsonValue value && value.TryGetValue(out string? severityString)
+                && decimal.TryParse(severityString, out var severityFromString))
+            {
+                return severityFromString;
+            }
+        }
+
+        return current;
+    }
+
+    private static void MergeLabels(JsonObject target, JsonObject? payload)
+    {
+        if (payload is null)
+        {
+            return;
+        }
+
+        if (payload.TryGetPropertyValue("labels", out var labelsNode) && labelsNode is JsonObject labelUpdates)
+        {
+            foreach (var property in labelUpdates)
+            {
+                if (property.Value is null || property.Value.GetValueKind() == JsonValueKind.Null)
+                {
+                    target.Remove(property.Key);
+                }
+                else
+                {
+                    target[property.Key] = property.Value.DeepClone();
+                }
+            }
+        }
+
+        if (payload.TryGetPropertyValue("labelsRemove", out var removeNode) && removeNode is JsonArray removeArray)
+        {
+            foreach (var item in removeArray)
+            {
+                if (item is JsonValue value && value.TryGetValue(out string? key) && !string.IsNullOrWhiteSpace(key))
+                {
+                    target.Remove(key);
+                }
+            }
+        }
+    }
+
+    private static string? DetermineExplainRef(JsonObject? payload, string? current)
+    {
+        var explainRef = ExtractString(payload, "explainRef") ?? ExtractString(payload, "explain_ref");
+        return explainRef ?? current;
+    }
+
+    private static string? DetermineComment(JsonObject? payload)
+    {
+        return ExtractString(payload, "comment")
+            ?? ExtractString(payload, "justification")
+            ?? ExtractString(payload, "note");
+    }
+
+    private static TriageActionEntry? CreateActionEntry(LedgerEventRecord record, JsonObject? payload)
+    {
+        var actionType = record.EventType switch
+        {
+            LedgerEventConstants.EventFindingStatusChanged => "status_change",
+            LedgerEventConstants.EventFindingCommentAdded => "comment",
+            LedgerEventConstants.EventFindingAssignmentChanged => "assign",
+            LedgerEventConstants.EventFindingRemediationPlanAdded => "remediation_plan",
+            LedgerEventConstants.EventFindingAcceptedRisk => "accept_risk",
+            LedgerEventConstants.EventFindingAttachmentAdded => "attach_evidence",
+            LedgerEventConstants.EventFindingClosed => "close",
+            _ => null
+        };
+
+        if (actionType is null)
+        {
+            return null;
+        }
+
+        var payloadClone = payload?.DeepClone()?.AsObject() ?? new JsonObject();
+        return new TriageActionEntry(
+            record.TenantId,
+            record.EventId,
+            record.EventId,
+            record.FindingId,
+            actionType,
+            payloadClone,
+            record.RecordedAt,
+            record.ActorId);
+    }
+
+    private static JsonObject CloneLabels(JsonObject? source)
+    {
+        return source is null ? new JsonObject() : (JsonObject)source.DeepClone();
+    }
+
+    private static JsonArray CloneArray(JsonArray source)
+    {
+        ArgumentNullException.ThrowIfNull(source);
+
+        var clone = new JsonArray();
+        foreach (var item in source)
+        {
+            clone.Add(item?.DeepClone());
+        }
+
+        return clone;
+    }
+
+    private static string? ExtractString(JsonObject? obj, string propertyName)
+    {
+        if (obj is null)
+        {
+            return null;
+        }
+
+        if (!obj.TryGetPropertyValue(propertyName, out var node) || node is null)
+        {
+            return null;
+        }
+
+        if (node is JsonValue value && value.TryGetValue(out string? result))
+        {
+            return string.IsNullOrWhiteSpace(result) ? null : result;
+        }
+
+        return node.ToString();
+    }
+
+    private static bool TryConvertDecimal(JsonNode? node, out decimal value)
+    {
+        switch (node)
+        {
+            case null:
+                value = default;
+                return false;
+            case JsonValue jsonValue when jsonValue.TryGetValue(out decimal decimalValue):
+                value = decimalValue;
+                return true;
+            case JsonValue jsonValue when jsonValue.TryGetValue(out double doubleValue):
+                value = Convert.ToDecimal(doubleValue);
+                return true;
+            default:
+                if (decimal.TryParse(node.ToString(), out var parsed))
+                {
+                    value = parsed;
+                    return true;
+                }
+
+                value = default;
+                return false;
+        }
+    }
+}