Add tests and implement timeline ingestion options with NATS and Redis subscribers

- Introduced `BinaryReachabilityLifterTests` to validate binary lifting functionality.
- Created `PackRunWorkerOptions` for configuring worker paths and execution persistence.
- Added `TimelineIngestionOptions` for configuring NATS and Redis ingestion transports.
- Implemented `NatsTimelineEventSubscriber` for subscribing to NATS events.
- Developed `RedisTimelineEventSubscriber` for reading from Redis Streams.
- Added `TimelineEnvelopeParser` to normalize incoming event envelopes.
- Created unit tests for `TimelineEnvelopeParser` to ensure correct field mapping.
- Implemented `TimelineAuthorizationAuditSink` for logging authorization outcomes.

ops/devops/docker/Dockerfile.hardened.template

@@ -7,6 +7,7 @@ ARG RUNTIME_IMAGE=mcr.microsoft.com/dotnet/aspnet:10.0-bookworm-slim
 ARG APP_PROJECT=src/Service/Service.csproj
 ARG CONFIGURATION=Release
 ARG PUBLISH_DIR=/app/publish
+ARG APP_BINARY=StellaOps.Service
 ARG APP_USER=stella
 ARG APP_UID=10001
 ARG APP_GID=10001
@@ -38,7 +39,8 @@ COPY --chown=${APP_UID}:${APP_GID} ops/devops/docker/healthcheck.sh /usr/local/b
 ENV ASPNETCORE_URLS=http://+:${APP_PORT} \
     DOTNET_EnableDiagnostics=0 \
     DOTNET_SYSTEM_GLOBALIZATION_INVARIANT=1 \
-    COMPlus_EnableDiagnostics=0
+    COMPlus_EnableDiagnostics=0 \
+    APP_BINARY=${APP_BINARY}
 
 USER ${APP_UID}:${APP_GID}
 EXPOSE ${APP_PORT}
@@ -50,4 +52,5 @@ RUN chmod 500 /app && \
     find /app -maxdepth 1 -type f -exec chmod 400 {} \; && \
     find /app -maxdepth 1 -type d -exec chmod 500 {} \;
 
-ENTRYPOINT ["./StellaOps.Service"]
+# Use shell form so APP_BINARY env can be expanded without duplicating the template per service
+ENTRYPOINT ["sh","-c","exec ./\"$APP_BINARY\""]