Add tests and implement timeline ingestion options with NATS and Redis subscribers

- Introduced `BinaryReachabilityLifterTests` to validate binary lifting functionality.
- Created `PackRunWorkerOptions` for configuring worker paths and execution persistence.
- Added `TimelineIngestionOptions` for configuring NATS and Redis ingestion transports.
- Implemented `NatsTimelineEventSubscriber` for subscribing to NATS events.
- Developed `RedisTimelineEventSubscriber` for reading from Redis Streams.
- Added `TimelineEnvelopeParser` to normalize incoming event envelopes.
- Created unit tests for `TimelineEnvelopeParser` to ensure correct field mapping.
- Implemented `TimelineAuthorizationAuditSink` for logging authorization outcomes.

scripts/mirror/mirror-create.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Deterministic wrapper for building mirror-thin-v1 bundles.
+# Usage: mirror-create.sh [--out out/mirror/thin] [--sign-key path.pem] [--oci] [--time-anchor path.json]
+
+OUT="out/mirror/thin"
+SIGN_KEY=""
+TIME_ANCHOR=""
+OCI=0
+
+usage() {
+  echo "Usage: $0 [--out <dir>] [--sign-key key.pem] [--oci] [--time-anchor path.json]" >&2
+  exit 2
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --out) OUT=${2:-}; shift ;;
+    --sign-key) SIGN_KEY=${2:-}; shift ;;
+    --time-anchor) TIME_ANCHOR=${2:-}; shift ;;
+    --oci) OCI=1 ;;
+    *) usage ;;
+  esac
+  shift
+done
+
+ROOT=$(cd "$(dirname "$0")/.." && pwd)
+pushd "$ROOT/.." >/dev/null
+
+export SIGN_KEY
+export TIME_ANCHOR_FILE=${TIME_ANCHOR:-}
+export OCI
+export OUT
+
+src/Mirror/StellaOps.Mirror.Creator/make-thin-v1.sh
+
+echo "Bundle built under $OUT"
+python scripts/mirror/verify_thin_bundle.py \
+  "$OUT/mirror-thin-v1.manifest.json" \
+  "$OUT/mirror-thin-v1.tar.gz" \
+  --bundle-meta "$OUT/mirror-thin-v1.bundle.json"
+
+popd >/dev/null
+echo "Create/verify completed"