Add tests and implement timeline ingestion options with NATS and Redis subscribers

- Introduced `BinaryReachabilityLifterTests` to validate binary lifting functionality.
- Created `PackRunWorkerOptions` for configuring worker paths and execution persistence.
- Added `TimelineIngestionOptions` for configuring NATS and Redis ingestion transports.
- Implemented `NatsTimelineEventSubscriber` for subscribing to NATS events.
- Developed `RedisTimelineEventSubscriber` for reading from Redis Streams.
- Added `TimelineEnvelopeParser` to normalize incoming event envelopes.
- Created unit tests for `TimelineEnvelopeParser` to ensure correct field mapping.
- Implemented `TimelineAuthorizationAuditSink` for logging authorization outcomes.

scripts/mirror/mirror-verify.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Verify a mirror-thin-v1 bundle and optional DSSE signatures.
+# Usage: mirror-verify.sh manifest.json bundle.tar.gz [--bundle-meta bundle.json] [--pubkey key.pub] [--tenant t] [--environment env]
+
+manifest=${1:-}
+bundle=${2:-}
+shift 2 || true
+
+bundle_meta=""
+pubkey=""
+tenant=""
+environment=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --bundle-meta) bundle_meta=${2:-}; shift ;;
+    --pubkey) pubkey=${2:-}; shift ;;
+    --tenant) tenant=${2:-}; shift ;;
+    --environment) environment=${2:-}; shift ;;
+    *) echo "Unknown arg $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+[[ -z "$manifest" || -z "$bundle" ]] && { echo "manifest and bundle required" >&2; exit 2; }
+
+args=("$manifest" "$bundle")
+[[ -n "$bundle_meta" ]] && args+=("--bundle-meta" "$bundle_meta")
+[[ -n "$pubkey" ]] && args+=("--pubkey" "$pubkey")
+[[ -n "$tenant" ]] && args+=("--tenant" "$tenant")
+[[ -n "$environment" ]] && args+=("--environment" "$environment")
+
+python scripts/mirror/verify_thin_bundle.py "${args[@]}"
+
+echo "Mirror bundle verification passed."